CVE-2026-122124
Description
A flaw was found in Yealink UVC40. An attacker with physical access to the device can exploit sensitive configuration data through the USB (Universal Serial Bus) interface to obtain root-level administrative privileges. This issue also allows the attacker to extract stored Wi-Fi network credentials and conduct unauthorized audio and video eavesdropping without triggering visual alerts on the device.
Statement
This vulnerability is rated as Moderate severity because exploitation requires direct physical interaction with the hardware interface, substantially limiting remote exposure. Red Hat enterprise software offerings do not package or distribute third-party Yealink device firmware, meaning Red Hat products are unaffected by this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
This can result in compromise of the system for which the password is used. An attacker could gain access to this file and learn the stored password or worse yet, change the password to one of their choosing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
