CVE-2026-122124

6.1 MEDIUM

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-669

All references

https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-103106
LOWCVE-2026-106553
LOWCVE-2026-106555
HIGHCVE-2026-110907
HIGHCVE-2026-111445PoC
MEDIUMCVE-2026-111793PoC
MEDIUMCVE-2026-114722PoC
HIGHCVE-2026-123010PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.