CRITICAL 9.0 NVD
CVE-2026-122120
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
References
- https://support.yealink.com/product-detail/0198a686-f259-7994-bd17-7f9d88c3359a
- https://www.yealink.com/en/trust-center/security-bulletins/yealink-plugin-softwares-remote
This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-11-04 via NVD.
Risk Timeline
CVE Disclosed2026-11-04 · -1 days ago
Remediation Resources
vulnfeed aggregates 18258 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.