CVE-2026-122120 in Plug-in Softwares
Summary
by MITRE • 11/04/2026
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The identified security flaw resides within the update mechanisms of Yealink plug-in software versions prior to build number 2.35.219.0. This vulnerability is classified as an unauthorized file write issue, specifically falling under CWE-732: Incorrect Permission Assignment for Critical Resource in standard classification systems. The core technical deficiency involves a failure to properly validate or sanitize the destination path and content during software update processes. When the application attempts to download and install new components or configuration files, it does not adequately restrict where these files can be written within the file system hierarchy. This lack of strict access control allows an attacker who has network-level access to manipulate the update process by directing the write operation to arbitrary locations on the host operating system rather than the intended application directory.
The operational impact of this vulnerability is severe, as it directly facilitates remote code execution without requiring authentication in specific exploitation scenarios. By exploiting the improper permission assignment, a malicious actor can overwrite critical executable files or configuration scripts with payloads crafted by the attacker. Once these modified files are executed during subsequent system operations or service restarts, the attacker gains the ability to run arbitrary commands on the compromised device. This effectively bypasses traditional authentication controls and allows for full compromise of the underlying infrastructure, potentially leading to data exfiltration, lateral movement within a network, or establishment of persistent backdoors.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Defense Evasion and Persistence, specifically those involving file system modifications and unauthorized access to resources. The ability to write files in unintended locations is often leveraged by malware authors to maintain footholds on compromised systems or to replace legitimate binaries with malicious ones for stealthier operation. In the context of Yealink devices, which are commonly used as VoIP endpoints and conferencing equipment, successful exploitation could allow an attacker to intercept communications, eavesdrop on calls, or use the device as a pivot point for further attacks against internal corporate networks.
To mitigate this risk, organizations must immediately upgrade Yealink plug-in software to version 2.35.219.0 or later, where these permission checks have been corrected. Until an update is applied, administrators should restrict network access to the affected devices using firewall rules and ensure that only trusted sources are allowed to initiate updates. Additionally, implementing strict file integrity monitoring on critical system directories can help detect unauthorized modifications resulting from exploitation attempts. Regular patch management cycles and vulnerability scanning specific to Yealink firmware versions are essential practices to maintain a secure operational environment and prevent potential remote code execution incidents.