{"id":"CVE-2021-27561","kind":"vulnerability","aliases":["CVE-2021-27561"],"related":[],"title":"Yealink Device Management: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability","description":"Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Yealink Device Management (DM) <= 3.6.0.20 allows unauthenticated command injection as root via /sm/api/v1/firewall/zone/services (CVSS 9.8). CISA KEV names it an SSRF, but the vendor and NVD describe OS command injection, giving unauthenticated RCE. Fixed in 3.6.0.31. Exploited in the wild per CISA KEV.","severity":"critical","cvss":10.0,"epss":0.82865,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Yealink Device Management","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Yealink Device Management","fixed":["3.6.0.31"],"affected":"<= 3.6.0.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["command-injection","device-management","exploited","infrastructure","rce","self-hosted","yealink"],"not_affected_if":["managed-hosting","no-yealink-device-management","not-internet-exposed","version-3.6.0.31-or-later"],"how_to_check":"Find your Yealink DM server version in the admin web UI (About/version info; the vendor does not document the exact location, so verify there). Anything <= 3.6.0.20 is vulnerable. Also check whether the DM server is reachable from the internet, and look in web logs for requests to /sm/api/v1/firewall/zone/services.","fix":"Upgrade Yealink Device Management to 3.6.0.31 or later (download via https://support.yealink.com/en/portal/home). Until then, do not expose the DM server to the internet. If it was exposed, treat the host as compromised.","status":"open","published_at":"2021-10-15T18:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:23+00:00","updated_at":"2026-10-23T20:49:07+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:29:23Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Yealink's instructions; the fixed version is unknown from these sources.","summary":"Yealink Device Management Server has a server-side request forgery flaw that lets an unauthenticated attacker make the server send requests on their behalf. The sources say this chains to unauthenticated remote code execution, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["yealink","self-hosted","device-management"],"confidence":0.8,"analyst_note":"Find the fixed version and the vendor advisory for CVE-2021-27561 on Yealink's site, and a way to check installed version, since the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-yealink-device-management"],"severity_if_unknown":"critical"},"cost_usd":0.000356,"input_tokens":2120,"output_tokens":287,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed version and the vendor advisory for CVE-2021-27561 on Yealink's site, and a way to check installed version, since the sources give neither.","search":"'-2021':15A,18A '-27561':16A,19A '/sm/api/v1/firewall/zone/services':51B '3.6.0.20':43B '3.6.0.31':74B '9.8':53B 'action':103C 'allow':44B,95C 'appli':104C 'cisa':54B,80B,101C 'code':99C 'command':27B,46B,67B 'command-inject':26B 'contain':85C 'cve':14A,17A 'cvss':52B 'describ':65B 'devic':2A,5A,30B,40B,83C 'device':21A,24A 'device-manag':29B 'dm':42B 'execut':100C 'exploit':32B,75B 'fix':72B 'forgeri':11A,91C 'give':69B 'host':37B 'infrastructur':33B 'inject':28B,47B,68B 'instruct':108C 'kev':55B,81B 'manag':3A,6A,31B,41B,84C 'management':22A,25A 'name':56B 'nvd':64B 'os':66B 'per':79B,106C 'rce':34B,71B 'remot':98C 'request':10A,90C 'requir':102C 'root':49B 'self':36B 'self-host':35B 'server':8A,88C 'server-sid':7A,87C 'side':9A,89C 'ssrf':12A,59B,92C 'unauthent':45B,70B,97C 'updat':105C 'vendor':62B,107C 'via':50B 'vulner':13A,93C 'wild':78B 'yealink':1A,4A,20A,23A,38B,39B,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-10-15T18:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-27561","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27561","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:50+00:00","note":null},{"source":"epss","external_id":"CVE-2021-27561","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27561","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-27561","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27561","severity":null,"published_at":"2021-10-15T18:15:07+00:00","modified_at":"2026-06-17T03:45:08+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-27561:28","url":null,"severity":null,"published_at":"2026-10-23T20:49:07+00:00","modified_at":"2026-10-23T20:49:07+00:00","first_seen_at":"2026-10-23T20:49:07+00:00","fetched_at":"2026-10-23T20:49:07+00:00","note":"Yealink bulletin (primary) gives affected <= 3.6.0.20, fixed 3.6.0.31; despite the KEV name 'SSRF', NVD/vendor describe unauthenticated OS command injection as root (CWE-78) at /sm/api/v1/firewall/zone/services. KEV-listed exploited. No public PoC link verified; SSD advisory has technical details. Install-version check method not published by vendor."}],"documents":[{"id":872,"url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-device-management-ssrf-vulnerability","title":"Yealink security bulletin CVE-2021-27561","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":872,"url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-device-management-ssrf-vulnerability","title":"Yealink security bulletin CVE-2021-27561","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":873,"url":"https://ssd-disclosure.com/ssd-advisory-yealink-dm-pre-auth-root-level-rce/","title":"SSD Advisory Yealink DM pre-auth root RCE","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":874,"url":"https://www.tenable.com/plugins/nessus/197075","title":"Tenable plugin 197075","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}