---
id: CVE-2026-122118
title: >-
  In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is
  enabled, a default 8-digit numeric PSK with insufficient strength is used
summary: >-
  In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is
  enabled, a default 8-digit numeric PSK with insufficient strength is used.
  Attackers can exploit this weakness via brute-force attacks to gain
  unauthorized netw…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-334
vendor: Yealink
product: AVHub
affected:
  - AVHub < 153.135.0.76
  - UVC86 < 151.435.0.66
  - smartvision_80 < 321.435.0.86
  - uvc40_e2 < 319.410.0.66
  - meetingborard_c < 328.321.0.40
  - meetingbar_a10 < 278.320.0.86
  - meetingbar_a40 < 289.320.0.81
  - meetingbar_a50 < 323.320.0.54
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T19:54:06.590482Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:00:57.515Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122118'
references:
  - url: >-
      https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.523Z'
---

## Overview

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.

## Affected

- `AVHub < 153.135.0.76`
- `UVC86 < 151.435.0.66`
- `smartvision_80 < 321.435.0.86`
- `uvc40_e2 < 319.410.0.66`
- `meetingborard_c < 328.321.0.40`
- `meetingbar_a10 < 278.320.0.86`
- `meetingbar_a40 < 289.320.0.81`
- `meetingbar_a50 < 323.320.0.54`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.