{"id":"CVE-2026-122124","kind":"vulnerability","aliases":["CVE-2026-122124"],"related":[],"title":"Yealink UVC40 E2: physical USB access steals Wi-Fi credentials and grants root","description":"On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.","summary":"Yealink UVC40 E2 video conferencing devices before firmware 319.410.0.71 leak Wi-Fi credentials and sensitive firmware configuration over the USB interface. An attacker with brief physical access can use that data to gain root on the device and, within Wi-Fi range, eavesdrop on audio and video without an LED alert.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","uvc40-e2","video-conferencing","wifi","yealink"],"not_affected_if":["firmware-319.410.0.71-or-later","no-public-physical-access","no-wifi-configured"],"how_to_check":"- Check the firmware version on the UVC40 E2 device against `319.410.0.71`.\n- Identify UVC40 E2 units in meeting rooms or other spaces where visitors could reach the USB port.","fix":"- Yealink UVC40 E2 firmware: move to `319.410.0.71` or later.","status":"open","published_at":"2026-11-04T19:17:39+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:16+00:00","updated_at":"2026-11-04T19:30:16+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T19:30:16Z","model":"claude-haiku-5-5","output":{"fix":"- Yealink UVC40 E2 firmware: move to `319.410.0.71` or later.","reach":"local","title":"Yealink UVC40 E2: physical USB access steals Wi-Fi credentials and grants root","impact":"high","summary":"Yealink UVC40 E2 video conferencing devices before firmware 319.410.0.71 leak Wi-Fi credentials and sensitive firmware configuration over the USB interface. An attacker with brief physical access can use that data to gain root on the device and, within Wi-Fi range, eavesdrop on audio and video without an LED alert.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["yealink","uvc40-e2","video-conferencing","firmware","wifi"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains root on device and eavesdrops audio and video","analyst_note":"Confirm from the Yealink advisory whether Wi-Fi is enabled by default and whether the USB attack needs any special configuration; NVD entry alone lacks vendor detail.","how_to_check":"- Check the firmware version on the UVC40 E2 device against `319.410.0.71`.\n- Identify UVC40 E2 units in meeting rooms or other spaces where visitors could reach the USB port.","plain_action":"","needs_analyst":true,"not_affected_if":["firmware-319.410.0.71-or-later","no-wifi-configured","no-public-physical-access"],"who_is_affected":"Organizations running Yealink UVC40 E2 video conferencing devices with firmware before 319.410.0.71. The risk depends on physical access to the USB interface and Wi-Fi range of the device, so units in locked or non-public rooms carry less exposure. unknown whether the sources describe a default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4163,"output_tokens":671,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122124':17A,20A '-2026':16A,19A '319.410.0.71':39B,90C 'abus':116C 'access':6A,58B,98C 'alert':83B,139C 'attack':54B,92C,129C 'audio':77B,132C 'brief':56B 'conferenc':28B,35B 'configur':48B,113C 'coverag':127C 'credenti':11A,44B,103C 'cve':15A,18A 'data':62B,109C 'devic':36B,68B,88C,123C,142C 'e2':3A,25B,33B,87C 'eavesdrop':75B,135C 'fi':10A,43B,73B,102C,126C 'firmwar':21B,38B,47B,112C 'gain':64B,118C 'grant':13A 'infrastructur':22B 'interfac':52B,107C 'leak':40B 'led':82B,138C 'may':130C 'perform':131C 'physic':4A,57B,97C 'privileg':120C 'rang':74B 'root':14A,65B,119C 'sensit':46B,108C 'short':95C 'short-term':94C 'steal':7A,100C 'term':96C 'usb':5A,51B,106C 'use':60B 'uvc40':2A,24B,32B,86C 'uvc40-e2':23B 'via':104C 'video':27B,34B,79B,134C 'video-conferenc':26B 'wi':9A,42B,72B,101C,125C 'wi-fi':8A,41B,71B 'wifi':29B 'within':70B,110C,124C 'without':80B 'yealink':1A,30B,31B,85C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Yealink UVC40 E2 video conferencing devices with firmware before 319.410.0.71. The risk depends on physical access to the USB interface and Wi-Fi range of the device, so units in locked or non-public rooms carry less exposure. unknown whether the sources describe a default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firmware","infrastructure","medium","uvc40e2","videoconferencing","wifi","yealink"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122124","severity":null,"published_at":"2026-11-04T19:17:39+00:00","modified_at":"2026-11-04T19:17:39+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}