{"id":"CVE-2026-122120","published":"2026-11-04T19:17:39.560","lastModified":"2026-11-04T19:17:39.560","description":"In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://support.yealink.com/product-detail/0198a686-f259-7994-bd17-7f9d88c3359a","tags":[]},{"url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-plugin-softwares-remote-code-execution-vulnerability","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in Yealink Plug-in Softwares before 2.35.219.0 allows unauthorized file writes under specific scenarios, potentially leading to remote code execution (RCE) if an attacker can place malicious files on the system.","exploitability":"Exploitation is difficult due to high attack complexity (AC:H) and likely requires specific conditions or configurations to trigger the vulnerable path.","blast_radius":"Successful exploitation could allow full compromise of confidentiality, integrity, and availability on the affected system, potentially affecting downstream services or users relying on the software.","remediation":"Upgrade to Yealink Plug-in Softwares version 2.35.219.0 or later to address the unauthorized file write vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","unauthorized-file-write","web","plugin"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:48:52.289Z"}}