CVE-2026-122118 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Certain Yealink products ship with a default 8-digit numeric pre-shared key for their Wi-Fi access point mode, which is too weak to resist brute-force guessing. An attacker who guesses it can join the network and intercept Wi-Fi traffic.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only Yealink products with the Wi-Fi access point function enabled and a default 8-digit numeric pre-shared key are described as affected. Devices with the access point function off, or with a changed key, are not exposed by this weakness. The specific models are unknown from the sources.
Not affected if custom-psk, wifi-ap-disabled
Who cares voip-phones, wifi, yealink
2026-04-15.In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.
This page as .md · .json · in your agent: get_signal("CVE-2026-122118") · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.