CVE-2026-122148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122148", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-11-04T18:22:44.285Z", "datePublished": "2026-11-04T18:22:44.631Z", "dateUpdated": "2026-11-05T19:06:30.709Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Android"], "product": "MeetingBoard Pro", "vendor": "Yealink", "versions": [{"lessThan": "331.320.0.64", "status": "affected", "version": "331.320.0.30", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-04T18:22:44.631Z"}, "references": [{"url": "https://www.yealink.com/en/trust-center/security-bulletins/web-screenshot-function-front-end-logic-bypass"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Yealink has remediated the aforementioned security vulnerability. Users can download the patched firmware via links for corresponding versions labeled \"Patched\" under the \"Affected Products\" section.</div><div>You can obtain the fixed software at the following URL:</div><div><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://support.yealink.com/docs/meetingboard-pro/meetingboard-pro-331-320-0-64-firmware-release-note/ccad99a50eb24584b43b5cac9eb5ba03\">https://support.yealink.com/docs/meetingboard-pro/meetingboard-pro-331-320-0-64-firmware-release-note/ccad99a50eb24584b43b5cac9eb5ba03</a></div><div>Mitigation Measures (for devices not yet upgraded or unable to be upgraded promptly):Exploitation of this vulnerability requires valid administrator credentials. It is recommended to review the complexity of administrator passwords and potential credential leakage risks. Change passwords to strong, complex passwords in a timely manner.</div>\n\n<br>"}], "value": "Yealink has remediated the aforementioned security vulnerability. Users can download the patched firmware via links for corresponding versions labeled \"Patched\" under the \"Affected Products\" section.\n\nYou can obtain the fixed software at the following URL:\n\n https://support.yealink.com/docs/meetingboard-pro/meetingboard-pro-331-320-0-64-firmware-release-note/ccad99a50eb24584b43b5cac9eb5ba03 \n\nMitigation Measures (for devices not yet upgraded or unable to be upgraded promptly):Exploitation of this vulnerability requires valid administrator credentials. It is recommended to review the complexity of administrator passwords and potential credential leakage risks. Change passwords to strong, complex passwords in a timely manner."}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T21:11:34.926174Z", "id": "CVE-2026-122148", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:06:30.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T21:11:34.926174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:06:23.651Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yealink", "product": "MeetingBoard Pro", "versions": [{"status": "affected", "version": "331.320.0.30", "lessThan": "331.320.0.64", "versionType": "custom"}], "platforms": ["Android"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Yealink has remediated the aforementioned security vulnerability. Users can download the patched firmware via links for corresponding versions labeled \"Patched\" under the \"Affected Products\" section.\n\nYou can obtain the fixed software at the following URL:\n\n https://support.yealink.com/docs/meetingboard-pro/meetingboard-pro-331-320-0-64-firmware-release-note/ccad99a50eb24584b43b5cac9eb5ba03 \n\nMitigation Measures (for devices not yet upgraded or unable to be upgraded promptly):Exploitation of this vulnerability requires valid administrator credentials. It is recommended to review the complexity of administrator passwords and potential credential leakage risks. Change passwords to strong, complex passwords in a timely manner.", "supportingMedia": [{"type": "text/html", "value": "<div>Yealink has remediated the aforementioned security vulnerability. Users can download the patched firmware via links for corresponding versions labeled \"Patched\" under the \"Affected Products\" section.</div><div>You can obtain the fixed software at the following URL:</div><div><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://support.yealink.com/docs/meetingboard-pro/meetingboard-pro-331-320-0-64-firmware-release-note/ccad99a50eb24584b43b5cac9eb5ba03\">https://support.yealink.com/docs/meetingboard-pro/meetingboard-pro-331-320-0-64-firmware-release-note/ccad99a50eb24584b43b5cac9eb5ba03</a></div><div>Mitigation Measures (for devices not yet upgraded or unable to be upgraded promptly):Exploitation of this vulnerability requires valid administrator credentials. It is recommended to review the complexity of administrator passwords and potential credential leakage risks. Change passwords to strong, complex passwords in a timely manner.</div>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.yealink.com/en/trust-center/security-bulletins/web-screenshot-function-front-end-logic-bypass"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-04T18:22:44.631Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122148", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:06:30.709Z", "dateReserved": "2026-11-04T18:22:44.285Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-11-04T18:22:44.631Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Android"], "product": "MeetingBoard Pro", "vendor": "Yealink", "versions": [{"lessThan": "331.320.0.64", "status": "affected", "version": "331.320.0.30", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network."}], "id": "CVE-2026-122148", "lastModified": "2026-11-12T19:11:21.503", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122148", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T21:11:34.926174Z", "version": "2.0.3"}}]}, "published": "2026-11-04T19:17:39.890", "references": [{"source": "cve@mitre.org", "url": "https://www.yealink.com/en/trust-center/security-bulletins/web-screenshot-function-front-end-logic-bypass"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "MeetingBoard: MeetingBoard: Unauthorized screenshot capture via front-end validation bypass", "id": "2567726", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567726"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.", "A flaw was found in the MeetingBoard web management module. An authenticated administrator on the local network can bypass client-side interface controls by directly modifying the web page Document Object Model (DOM). By circumventing these front-end restrictions, an attacker can invoke restricted interfaces to trigger screenshot operations, resulting in unauthorized information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122148", "public_date": "2026-11-04T18:22:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122148\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122148\nhttps://www.yealink.com/en/trust-center/security-bulletins/web-screenshot-function-front-end-logic-bypass"], "statement": "This vulnerability has been rated as Moderate because exploitation requires adjacent network access and existing administrative privileges, limiting the overall attack surface to trusted operators. Furthermore, Yealink MeetingBoard is third-party hardware firmware that is neither packaged nor supported within Red Hat software offerings. Consequently, Red Hat products are unaffected by this vulnerability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["Android"], "status": "affected", "versions": {"scheme": "generic", "value": "[331.320.0.30,331.320.0.64)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "meetingboard_pro", "vendor": "yealink"}], "created": "2026-11-04T19:45:14.490431+00:00", "updated": "2026-11-06T21:28:47.676150+00:00", "vendors": ["yealink", "yealink$PRODUCT$meetingboard_pro"]}