CVE-2026-122120 · Other
NO FIX YET · SEE WHAT TO DO
Yealink Plug-in Softwares before 2.35.219.0 allow an unauthorized file write under specific scenarios. An attacker can use this to achieve remote code execution.
first public Nov 4, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organizations running Yealink Plug-in Software before version 2.35.219.0. The sources do not describe the specific scenarios that trigger the file write, so whether a given deployment is exposed is unknown.
Not affected if version-2.35.219.0-or-later
Who cares plug-in, yealink
2.35.219.02.35.219.0 or laterIn Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-122120") · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.