CVE-2026-122124

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122124", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-11-04T18:08:31.579Z", "datePublished": "2026-11-04T18:08:31.917Z", "dateUpdated": "2026-11-09T21:06:44.839Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "UVC40 E2", "vendor": "Yealink", "versions": [{"lessThan": "319.410.0.71", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi\u2011Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi\u2011Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-04T18:08:31.917Z"}, "references": [{"url": "https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T21:06:31.350611Z", "id": "CVE-2026-122124", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T21:06:44.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122124", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T21:06:31.350611Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T21:06:38.985Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yealink", "product": "UVC40 E2", "versions": [{"status": "affected", "version": "0", "lessThan": "319.410.0.71", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi\u2011Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi\u2011Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-04T18:08:31.917Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122124", "state": "PUBLISHED", "dateUpdated": "2026-11-09T21:06:44.839Z", "dateReserved": "2026-11-04T18:08:31.579Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-11-04T18:08:31.917Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "UVC40 E2", "vendor": "Yealink", "versions": [{"lessThan": "319.410.0.71", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi\u2011Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi\u2011Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device."}], "id": "CVE-2026-122124", "lastModified": "2026-11-12T19:11:21.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122124", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T21:06:31.350611Z", "version": "2.0.3"}}]}, "published": "2026-11-04T19:17:39.727", "references": [{"source": "cve@mitre.org", "url": "https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "UVC40: Yealink UVC40: Privilege escalation via physical USB access", "id": "2567466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567466"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-260", "details": ["On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi\u2011Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi\u2011Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.", "A flaw was found in Yealink UVC40. An attacker with physical access to the device can exploit sensitive configuration data through the USB (Universal Serial Bus) interface to obtain root-level administrative privileges. This issue also allows the attacker to extract stored Wi-Fi network credentials and conduct unauthorized audio and video eavesdropping without triggering visual alerts on the device."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122124", "public_date": "2026-11-04T18:08:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122124\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122124\nhttps://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires direct physical interaction with the hardware interface, substantially limiting remote exposure. Red Hat enterprise software offerings do not package or distribute third-party Yealink device firmware, meaning Red Hat products are unaffected by this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,319.410.0.71)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "UVC40 E2", "source": "cna", "vendor": "Yealink"}, "product": "uvc40_e2", "vendor": "yealink"}], "created": "2026-11-04T19:45:14.490668+00:00", "updated": "2026-11-06T21:28:50.092110+00:00", "vendors": ["yealink", "yealink$PRODUCT$uvc40_e2"]}