CVE-2026-122118 in AVHub
Summary
by MITRE • 11/04/2026
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Yealink products prior to the April 15, 2026 release involves a critical misconfiguration within the device's wireless networking capabilities. Specifically, when the built-in Wireless Access Point function is activated, the system defaults to using an eight-digit numeric Pre-Shared Key for WPA or WPA2 encryption. This default credential exhibits severely insufficient entropy and complexity, as it consists solely of decimal digits rather than a mix of uppercase and lowercase letters, numbers, and special characters. The use of such a predictable and short key represents a fundamental failure in secure configuration management, leaving the wireless network perimeter exposed to trivial exploitation by any adversary with proximity to the device or access to its administrative interface defaults.
From a technical perspective, this flaw aligns directly with CWE-798: Use of Hard-coded Credentials and CWE-321: Use of a One-Time Key twice if the key is reused across devices, though it primarily manifests as CWE-521: Weak Password Requirements. The eight-digit numeric constraint limits the total possible combinations to exactly ten million (10^8). While this number may seem substantial at first glance, modern computing hardware and specialized brute-force tools can exhaust this keyspace in a matter of minutes or even seconds. Furthermore, because many enterprise devices ship with identical default credentials for ease of initial deployment, attackers often utilize pre-computed rainbow tables or dictionary attacks that target common vendor defaults, reducing the effort required to compromise the network significantly below what is necessary for random eight-digit numeric passwords.
The operational impact of this vulnerability extends beyond simple unauthorized access. An attacker who successfully brute-forces the Wi-Fi password gains full layer-two connectivity within the local area network. This position allows for a wide range of malicious activities, including man-in-the-middle attacks to intercept unencrypted traffic, ARP spoofing to redirect data flows through compromised hosts, and lateral movement into internal systems that may not have robust perimeter defenses. In environments where Yealink devices are used as part of unified communications infrastructure, such access could also facilitate the interception of voice or video conferencing data, leading to significant confidentiality breaches and potential compliance violations under regulations like GDPR or HIPAA if sensitive information is transmitted over the compromised link.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. Administrators should immediately disable the Wi-Fi AP function on all affected Yealink devices unless it is strictly required for specific operational needs, thereby removing the attack surface entirely. If wireless functionality is necessary, the default eight-digit numeric PSK must be replaced with a strong passphrase that meets modern complexity standards, ideally incorporating at least twelve to sixteen characters from multiple character sets. Additionally, organizations should implement network segmentation policies to isolate IoT and communication devices into separate VLANs with restricted access controls, limiting the blast radius of any potential compromise. Regular audits of default credentials across all connected endpoints are essential to prevent similar misconfigurations in other hardware types within the enterprise environment.
This vulnerability is categorized under MITRE ATT&CK technique T1078: Valid Accounts when considering the use of valid but weak network credentials, and it facilitates initial access vectors described in T1592: Gather Victim Host Information through passive reconnaissance if an attacker scans for open Wi-Fi networks with default keys. The lack of rate limiting on authentication attempts further exacerbates the risk by allowing rapid brute-force iterations without triggering account lockouts or alerts. Addressing this issue requires a shift from convenience-driven defaults to security-by-design principles, ensuring that all network-facing services enforce strong cryptographic standards and unique per-device credentials rather than relying on static, easily guessable passphrases.