{"id":"CVE-2026-122118","title":"In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used","summary":"In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized netw…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-334"],"vendor":"Yealink","product":"AVHub","affected":["AVHub < 153.135.0.76","UVC86 < 151.435.0.66","smartvision_80 < 321.435.0.86","uvc40_e2 < 319.410.0.66","meetingborard_c < 328.321.0.40","meetingbar_a10 < 278.320.0.86","meetingbar_a40 < 289.320.0.81","meetingbar_a50 < 323.320.0.54"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T19:54:06.590482Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T20:00:57.515Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122118","references":[{"url":"https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.523Z","slug":"CVE-2026-122118","body":"## Overview\n\nIn certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.\n\n## Affected\n\n- `AVHub < 153.135.0.76`\n- `UVC86 < 151.435.0.66`\n- `smartvision_80 < 321.435.0.86`\n- `uvc40_e2 < 319.410.0.66`\n- `meetingborard_c < 328.321.0.40`\n- `meetingbar_a10 < 278.320.0.86`\n- `meetingbar_a40 < 289.320.0.81`\n- `meetingbar_a50 < 323.320.0.54`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}