CVE-2026-122116 in AX83H
Summary
by MITRE • 11/04/2026
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The identified security issue resides within the Wi-Fi 802.1X Protected Extensible Authentication Protocol (PEAP) network configuration functionality of specific Yealink terminal devices, affecting versions released prior to April 21, 2026. This vulnerability represents a critical failure in access control mechanisms, specifically categorized under CWE-269: Improper Privilege Management or CWE-862: Missing Authorization. The core technical flaw lies in the insufficient validation of user roles when interacting with the device's network configuration interfaces. Consequently, authenticated users who possess only standard or guest-level privileges are able to access and modify sensitive 802.1X PEAP settings that should be restricted exclusively to administrative accounts. This misconfiguration allows non-administrative entities to alter critical authentication parameters without triggering appropriate authorization checks, thereby bypassing the intended security boundaries of the device's operational framework.
The operational impact of this vulnerability is severe due to the nature of 802.1X PEAP configurations, which typically handle sensitive network access credentials such as client certificates and private keys used for mutual authentication with enterprise RADIUS servers. By exposing these configuration parameters to unauthorized users, attackers can potentially extract stored credentials or modify them to facilitate man-in-the-middle attacks. An adversary with local physical access or compromised low-privilege remote access could manipulate the PEAP settings to redirect authentication traffic to a rogue server, thereby capturing user passwords and certificates in plaintext or exploiting weak certificate validation logic. This not only compromises the confidentiality of individual user credentials but also undermines the integrity of the entire network segmentation strategy that relies on 802.1X for secure device onboarding and access control. The vulnerability aligns with MITRE ATT&CK technique T1539: Steal Web Session Cookie, as it involves the unauthorized exfiltration or manipulation of session-related authentication materials, although in this context, it extends to broader credential theft via configuration tampering rather than just cookie extraction.
To mitigate this risk, organizations must ensure that all Yealink endpoints are updated to firmware versions released on or after April 21, 2026, which implement the necessary access control restrictions by default. The patched firmware explicitly restricts modification privileges for 802.1X configuration parameters to administrator accounts only, thereby enforcing proper separation of duties and preventing privilege escalation through misconfigured interfaces. In environments where immediate patching is not feasible due to operational constraints, administrators should enforce strict network segmentation policies that limit the ability of untrusted or low-privilege users to interact with device management APIs. Additionally, implementing robust monitoring for unauthorized configuration changes can help detect potential exploitation attempts in real-time. Regular audits of user privilege levels and continuous verification of access control lists are essential practices to maintain a secure posture against such improper access control vulnerabilities.