{"id":"CVE-2026-122120","kind":"vulnerability","aliases":["CVE-2026-122120"],"related":[],"title":"Yealink plug-in software: unauthorized file write enables remote code execution","description":"In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.","summary":"Yealink Plug-in Softwares before 2.35.219.0 allow an unauthorized file write under specific scenarios. An attacker can use this to achieve remote code execution.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","plug-in","yealink"],"not_affected_if":["version-2.35.219.0-or-later"],"how_to_check":"- Check the installed Yealink Plug-in Software version against the fixed version `2.35.219.0`","fix":"- Yealink Plug-in Software: `2.35.219.0` or later","status":"open","published_at":"2026-11-04T19:17:39+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:06+00:00","updated_at":"2026-11-04T19:30:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-04T19:30:06Z","model":"claude-haiku-5-5","output":{"fix":"- Yealink Plug-in Software: `2.35.219.0` or later","reach":"unknown","title":"Yealink plug-in software: unauthorized file write enables remote code execution","impact":"high","summary":"Yealink Plug-in Softwares before 2.35.219.0 allow an unauthorized file write under specific scenarios. An attacker can use this to achieve remote code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["yealink","plug-in"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the affected machine remotely","analyst_note":"Find the NVD record's specific trigger scenarios and the vendor advisory to confirm reach, auth and user interaction requirements (https://nvd.nist.gov/vuln/detail/CVE-2026-122120).","how_to_check":"- Check the installed Yealink Plug-in Software version against the fixed version `2.35.219.0`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-2.35.219.0-or-later"],"who_is_affected":"Organizations running Yealink Plug-in Software before version 2.35.219.0. The sources do not describe the specific scenarios that trigger the file write, so whether a given deployment is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000666,"input_tokens":4098,"output_tokens":513,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122120':15A,18A '-2026':14A,17A '2.35.219.0':30B,56C 'achiev':45B,74C 'allow':31B 'attack':40B,72C 'code':11A,47B,76C 'cve':13A,16A 'enabl':9A 'execut':12A,48B,77C 'exploit':70C 'file':7A,34B,61C 'may':68C 'plug':3A,21B,26B,52C 'plug-in':2A,20B,25B,51C 'remot':10A,46B,75C 'scenario':38B,66C 'softwar':5A,28B,54C 'specif':37B,65C 'unauthor':6A,33B,60C 'use':42B 'vulner':63C 'write':8A,35B,62C 'yealink':1A,23B,24B,50C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Yealink Plug-in Software before version 2.35.219.0. The sources do not describe the specific scenarios that trigger the file write, so whether a given deployment is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","other","plugin","yealink"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122120","severity":null,"published_at":"2026-11-04T19:17:39+00:00","modified_at":"2026-11-04T19:17:39+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}