---
id: "CVE-2021-27561"
kind: "vulnerability"
aliases: ["CVE-2021-27561"]
title: "Yealink Device Management: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.82865
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Yealink Device Management", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Yealink Device Management", "fixed": ["3.6.0.31"], "affected": "<= 3.6.0.20", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["command-injection", "device-management", "exploited", "infrastructure", "rce", "self-hosted", "yealink"]
not_affected_if: ["managed-hosting", "no-yealink-device-management", "not-internet-exposed", "version-3.6.0.31-or-later"]
published_at: "2021-10-15T18:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:49:07+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27561", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-27561", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27561", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:49:07+00:00"}]
---

# Yealink Device Management: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability

Yealink Device Management (DM) <= 3.6.0.20 allows unauthenticated command injection as root via /sm/api/v1/firewall/zone/services (CVSS 9.8). CISA KEV names it an SSRF, but the vendor and NVD describe OS command injection, giving unauthenticated RCE. Fixed in 3.6.0.31. Exploited in the wild per CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Yealink Device Management affected ? fixed ?
- vendor:Yealink Device Management affected <= 3.6.0.20 fixed 3.6.0.31

## How to check

Find your Yealink DM server version in the admin web UI (About/version info; the vendor does not document the exact location, so verify there). Anything <= 3.6.0.20 is vulnerable. Also check whether the DM server is reachable from the internet, and look in web logs for requests to /sm/api/v1/firewall/zone/services.

## Fix

Upgrade Yealink Device Management to 3.6.0.31 or later (download via https://support.yealink.com/en/portal/home). Until then, do not expose the DM server to the internet. If it was exposed, treat the host as compromised.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27561
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-27561
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-27561
- 2026-10-23T20:49:07+00:00 analyst — Yealink bulletin (primary) gives affected <= 3.6.0.20, fixed 3.6.0.31; despite the KEV name 'SSRF', NVD/vendor describe unauthenticated OS command injection as root (CWE-78) at /sm/api/v1/firewall/zone/services. KEV-listed exploited. No public PoC link verified; SSD advisory has technical details. Install-version check method not published by vendor.

## Documents

- [advisory] Yealink security bulletin CVE-2021-27561 https://www.yealink.com/en/trust-center/security-bulletins/yealink-device-management-ssrf-vulnerability
- [describes] SSD Advisory Yealink DM pre-auth root RCE https://ssd-disclosure.com/ssd-advisory-yealink-dm-pre-auth-root-level-rce/
- [fix] Yealink security bulletin CVE-2021-27561 https://www.yealink.com/en/trust-center/security-bulletins/yealink-device-management-ssrf-vulnerability
- [mentions] Tenable plugin 197075 https://www.tenable.com/plugins/nessus/197075

## From the sources

Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_