---
id: CVE-2026-122124
title: >-
  On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term
  physical access can steal Wi‑Fi credentials via the USB interface
summary: >-
  On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term
  physical access can steal Wi‑Fi credentials via the USB interface. Sensitive
  data within the firmware configuration can be abused to gain root privileges
  on the…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-669
vendor: Yealink
product: UVC40 E2
affected:
  - uvc40_e2 < 319.410.0.71
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:08:31.917Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122124'
references:
  - url: >-
      https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.478Z'
---

## Overview

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.

## Affected

- `uvc40_e2 < 319.410.0.71`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.