No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Jeroen Hermans (CloudAware)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-52918 | CWE-863 Incorrect Authorization | 5.0 Medium |
The affected products fail to enforce access restrictions on OpenAPIs for frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. Mitigation: Users of Yealink are encouraged to navigate to Yealink's support portal andupdate to the following versions: ↗ Vendor fix: SIP-T19P_E2: Version 53.84.0.160 or higher Vendor fix: SIP-T21P_E2: Version 52.84.0.160 or higher Affected, fixed & timelineAffected:
Vendor fix: SIP-T23G: Version 44.84.0.160 or higher Vendor fix: SIP-T40G: Version 76.84.0.160 or higher Vendor fix: SIP-T40P: Version 54.84.0.160 or higher Vendor fix: SIP-T27G: Version 69.86.0.160 or higher Vendor fix: SIP-T41S: Version 66.86.0.83 or higher Vendor fix: SIP-T42S: Version 66.86.0.83 or higher Vendor fix: SIP-T46S: Version 66.86.0.83 or higher Vendor fix: SIP- T48S: Version 66.86.0.83 or higher Vendor fix: SIP-CP920: Version 78.86.0.15 or higher Vendor fix: SIP-T53: Version 96.86.0.75 or higher Vendor fix: SIP-T53W: Version 96.86.0.75 or higher Vendor fix: SIP-T54W: Version 96.86.0.75 or higher Vendor fix: SIP-T57W: Version 96.86.0.75 or higher Vendor fix: SIP-T56A: Version 58.86.0.160 or higher Vendor fix: SIP-T58: Version 58.86.0.160 or higher Vendor fix: W52P: Version 25.81.0.160 or higher Vendor fix: W60B: Version 77.85.0.160 or higher Vendor fix: CP960: Version 73.86.0.160 or higher Vendor fix: SIP-T27P: Version 45.83.0.161 or higher Vendor fix: SIP-T29G: Version 46.83.0.160 and prior Vendor fix: SIP-T41P: Version 36.83.0.160 and prior Vendor fix: SIP-T42G: Version 29.83.0.160 and prior Vendor fix: SIP-T46G: Version 28.83.0.160 and prior Vendor fix: SIP-T48G: Version 35.83.0.160 and prior Mitigation: RPS (Redirect and Provisioning Service): Yealink has deployed a fix to all cloud service instances Mitigation: The following products are no longer receiving RPS support: Vendor fix: SIP-T20P Vendor fix: SIP-T22P Vendor fix: SIP-T26P Vendor fix: SIP-T27P Vendor fix: T52S Vendor fix: T54S Mitigation: For more information, see the associated Yealink security advisory: Yealink RPS Issue Statement |
| CVE-2025-52917 | CWE-770 Allocation of Resources Without Limits or Throttling | 4.3 Medium |
The affected products lack rate limiting, potentially enabling information disclosure via excessive requests. Mitigation: Users of Yealink are encouraged to navigate to Yealink's support portal andupdate to the following versions: ↗ Vendor fix: SIP-T19P_E2: Version 53.84.0.160 or higher Vendor fix: SIP-T21P_E2: Version 52.84.0.160 or higher Affected, fixed & timelineAffected:
Vendor fix: SIP-T23G: Version 44.84.0.160 or higher Vendor fix: SIP-T40G: Version 76.84.0.160 or higher Vendor fix: SIP-T40P: Version 54.84.0.160 or higher Vendor fix: SIP-T27G: Version 69.86.0.160 or higher Vendor fix: SIP-T41S: Version 66.86.0.83 or higher Vendor fix: SIP-T42S: Version 66.86.0.83 or higher Vendor fix: SIP-T46S: Version 66.86.0.83 or higher Vendor fix: SIP- T48S: Version 66.86.0.83 or higher Vendor fix: SIP-CP920: Version 78.86.0.15 or higher Vendor fix: SIP-T53: Version 96.86.0.75 or higher Vendor fix: SIP-T53W: Version 96.86.0.75 or higher Vendor fix: SIP-T54W: Version 96.86.0.75 or higher Vendor fix: SIP-T57W: Version 96.86.0.75 or higher Vendor fix: SIP-T56A: Version 58.86.0.160 or higher Vendor fix: SIP-T58: Version 58.86.0.160 or higher Vendor fix: W52P: Version 25.81.0.160 or higher Vendor fix: W60B: Version 77.85.0.160 or higher Vendor fix: CP960: Version 73.86.0.160 or higher Vendor fix: SIP-T27P: Version 45.83.0.161 or higher Vendor fix: SIP-T29G: Version 46.83.0.160 and prior Vendor fix: SIP-T41P: Version 36.83.0.160 and prior Vendor fix: SIP-T42G: Version 29.83.0.160 and prior Vendor fix: SIP-T46G: Version 28.83.0.160 and prior Vendor fix: SIP-T48G: Version 35.83.0.160 and prior Mitigation: RPS (Redirect and Provisioning Service): Yealink has deployed a fix to all cloud service instances Mitigation: The following products are no longer receiving RPS support: Vendor fix: SIP-T20P Vendor fix: SIP-T22P Vendor fix: SIP-T26P Vendor fix: SIP-T27P Vendor fix: T52S Vendor fix: T54S Mitigation: For more information, see the associated Yealink security advisory: Yealink RPS Issue Statement |
| CVE-2025-52919 | CWE-295 Improper Certificate Validation | 4.3 Medium |
The certificate upload function in the affected products does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. Mitigation: Users of Yealink are encouraged to navigate to Yealink's support portal andupdate to the following versions: ↗ Vendor fix: SIP-T19P_E2: Version 53.84.0.160 or higher Vendor fix: SIP-T21P_E2: Version 52.84.0.160 or higher Affected, fixed & timelineAffected:
Vendor fix: SIP-T23G: Version 44.84.0.160 or higher Vendor fix: SIP-T40G: Version 76.84.0.160 or higher Vendor fix: SIP-T40P: Version 54.84.0.160 or higher Vendor fix: SIP-T27G: Version 69.86.0.160 or higher Vendor fix: SIP-T41S: Version 66.86.0.83 or higher Vendor fix: SIP-T42S: Version 66.86.0.83 or higher Vendor fix: SIP-T46S: Version 66.86.0.83 or higher Vendor fix: SIP- T48S: Version 66.86.0.83 or higher Vendor fix: SIP-CP920: Version 78.86.0.15 or higher Vendor fix: SIP-T53: Version 96.86.0.75 or higher Vendor fix: SIP-T53W: Version 96.86.0.75 or higher Vendor fix: SIP-T54W: Version 96.86.0.75 or higher Vendor fix: SIP-T57W: Version 96.86.0.75 or higher Vendor fix: SIP-T56A: Version 58.86.0.160 or higher Vendor fix: SIP-T58: Version 58.86.0.160 or higher Vendor fix: W52P: Version 25.81.0.160 or higher Vendor fix: W60B: Version 77.85.0.160 or higher Vendor fix: CP960: Version 73.86.0.160 or higher Vendor fix: SIP-T27P: Version 45.83.0.161 or higher Vendor fix: SIP-T29G: Version 46.83.0.160 and prior Vendor fix: SIP-T41P: Version 36.83.0.160 and prior Vendor fix: SIP-T42G: Version 29.83.0.160 and prior Vendor fix: SIP-T46G: Version 28.83.0.160 and prior Vendor fix: SIP-T48G: Version 35.83.0.160 and prior Mitigation: RPS (Redirect and Provisioning Service): Yealink has deployed a fix to all cloud service instances Mitigation: The following products are no longer receiving RPS support: Vendor fix: SIP-T20P Vendor fix: SIP-T22P Vendor fix: SIP-T26P Vendor fix: SIP-T27P Vendor fix: T52S Vendor fix: T54S Mitigation: For more information, see the associated Yealink security advisory: Yealink RPS Issue Statement |
| CVE-2025-52916 | CWE-307 Improper Restriction of Excessive Authentication Attempts | 2.2 Low |
The affected products lack serial number verification attempt limits, enabling brute-force enumeration (last five digits). Mitigation: Users of Yealink are encouraged to navigate to Yealink's support portal andupdate to the following versions: ↗ Vendor fix: SIP-T19P_E2: Version 53.84.0.160 or higher Vendor fix: SIP-T21P_E2: Version 52.84.0.160 or higher Affected, fixed & timelineAffected:
Vendor fix: SIP-T23G: Version 44.84.0.160 or higher Vendor fix: SIP-T40G: Version 76.84.0.160 or higher Vendor fix: SIP-T40P: Version 54.84.0.160 or higher Vendor fix: SIP-T27G: Version 69.86.0.160 or higher Vendor fix: SIP-T41S: Version 66.86.0.83 or higher Vendor fix: SIP-T42S: Version 66.86.0.83 or higher Vendor fix: SIP-T46S: Version 66.86.0.83 or higher Vendor fix: SIP- T48S: Version 66.86.0.83 or higher Vendor fix: SIP-CP920: Version 78.86.0.15 or higher Vendor fix: SIP-T53: Version 96.86.0.75 or higher Vendor fix: SIP-T53W: Version 96.86.0.75 or higher Vendor fix: SIP-T54W: Version 96.86.0.75 or higher Vendor fix: SIP-T57W: Version 96.86.0.75 or higher Vendor fix: SIP-T56A: Version 58.86.0.160 or higher Vendor fix: SIP-T58: Version 58.86.0.160 or higher Vendor fix: W52P: Version 25.81.0.160 or higher Vendor fix: W60B: Version 77.85.0.160 or higher Vendor fix: CP960: Version 73.86.0.160 or higher Vendor fix: SIP-T27P: Version 45.83.0.161 or higher Vendor fix: SIP-T29G: Version 46.83.0.160 and prior Vendor fix: SIP-T41P: Version 36.83.0.160 and prior Vendor fix: SIP-T42G: Version 29.83.0.160 and prior Vendor fix: SIP-T46G: Version 28.83.0.160 and prior Vendor fix: SIP-T48G: Version 35.83.0.160 and prior Mitigation: RPS (Redirect and Provisioning Service): Yealink has deployed a fix to all cloud service instances Mitigation: The following products are no longer receiving RPS support: Vendor fix: SIP-T20P Vendor fix: SIP-T22P Vendor fix: SIP-T26P Vendor fix: SIP-T27P Vendor fix: T52S Vendor fix: T54S Mitigation: For more information, see the associated Yealink security advisory: Yealink RPS Issue Statement |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-52918 | 5.0 Medium | Yealink RPS Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. |
| CVE-2025-52917 | 4.3 Medium | Yealink RPS The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. |
| CVE-2025-52919 | 4.3 Medium | Yealink RPS In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certif… |
| CVE-2025-52916 | 2.2 Low | Yealink RPS Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits). |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.