{"id":"CVE-2026-122116","kind":"vulnerability","aliases":["CVE-2026-122116"],"related":[],"title":"Yealink terminal devices: Wi-Fi 802.1X credentials exposed to unauthorized users","description":"Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.","summary":"Certain Yealink terminal devices running firmware before 2026-04-21 have an access control flaw in the Wi-Fi 802.1X PEAP network configuration function. An attacker with access to the device's configuration can read deployed 802.1X network authentication credentials.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["802.1x","infrastructure","peap","voip-phones","wi-fi","yealink"],"not_affected_if":["latest-firmware","no-802.1x-peap"],"how_to_check":"- Check the installed firmware version on each Yealink terminal against the fixed release from the vendor (unknown in the sources).\n- Check whether 802.1X PEAP Wi-Fi is configured on the device; the sources do not name a specific setting to inspect.","fix":"- Move to the latest Yealink firmware, which restricts 802.1X configuration modification to administrator accounts only by default. Exact fixed version: unknown.","status":"open","published_at":"2026-11-04T18:17:43+00:00","first_seen_at":"2026-11-04T18:28:34+00:00","triaged_at":"2026-11-04T18:29:41+00:00","updated_at":"2026-11-04T18:29:41+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T18:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move to the latest Yealink firmware, which restricts 802.1X configuration modification to administrator accounts only by default. Exact fixed version: unknown.","reach":"unknown","title":"Yealink terminal devices: Wi-Fi 802.1X credentials exposed to unauthorized users","impact":"medium","summary":"Certain Yealink terminal devices running firmware before 2026-04-21 have an access control flaw in the Wi-Fi 802.1X PEAP network configuration function. An attacker with access to the device's configuration can read deployed 802.1X network authentication credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["yealink","wi-fi","802.1x","peap","voip-phones"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Wi-Fi 802.1X authentication credentials readable by unauthorized users","analyst_note":"Confirm affected models, fixed firmware version, and whether an attacker needs network or local access, from the Yealink security advisory.","how_to_check":"- Check the installed firmware version on each Yealink terminal against the fixed release from the vendor (unknown in the sources).\n- Check whether 802.1X PEAP Wi-Fi is configured on the device; the sources do not name a specific setting to inspect.","plain_action":"","needs_analyst":true,"not_affected_if":["no-802.1x-peap","latest-firmware"],"who_is_affected":"Yealink terminal devices with firmware before 2026-04-21 that use Wi-Fi 802.1X PEAP network access authentication are affected. The sources do not say which exact models are affected or what access level an attacker needs; teams not using 802.1X PEAP Wi-Fi on these devices can likely skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000747,"input_tokens":4167,"output_tokens":661,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-04':39B,80C '-122116':16A,19A '-2026':15A,18A '-21':40B,81C '2026':38B,79C '802.1':7A,20B,51B,69B,93C,103C,122C 'access':43B,60B,85C,106C 'account':129C 'address':117C 'administr':128C 'attack':58B 'authent':72B,107C 'certain':31B,74C 'configur':55B,65B,97C,124C 'contain':82C 'control':44B,86C 'credenti':9A,73B,108C 'cve':14A,17A 'default':132C 'deploy':68B,102C 'devic':3A,34B,63B,77C 'expos':10A,101C 'fi':6A,29B,50B,92C 'firmwar':36B,115C 'flaw':45B,100C 'function':56B,98C 'improp':84C 'infrastructur':22B 'latest':113C 'modif':125C 'network':54B,71B,96C,105C 'peap':23B,53B,95C 'phone':26B 'privileg':126C 'read':67B 'restrict':121C 'run':35B 'termin':2A,33B,76C 'unauthor':12A,110C 'user':13A,111C 'voip':25B 'voip-phon':24B 'vulner':87C,119C 'wi':5A,28B,49B,91C 'wi-fi':4A,27B,48B,90C 'x':8A,21B,52B,70B,94C,104C,123C 'yealink':1A,30B,32B,75C,114C","nicknames":[],"mitigations":[],"who_affected":"Yealink terminal devices with firmware before 2026-04-21 that use Wi-Fi 802.1X PEAP network access authentication are affected. The sources do not say which exact models are affected or what access level an attacker needs; teams not using 802.1X PEAP Wi-Fi on these devices can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["8021x","infrastructure","medium","peap","voipphones","wifi","yealink"],"campaign_type":null,"first_public_at":"2026-11-04T18:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122116","severity":null,"published_at":"2026-11-04T18:17:43+00:00","modified_at":"2026-11-04T18:17:43+00:00","first_seen_at":"2026-11-04T18:28:34+00:00","fetched_at":"2026-11-04T18:28:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}