Patch Ticker

Yealink meeting devices use weak default Wi-Fi password

Anyone can get onto Yealink meeting-room devices' Wi-Fi with the default password.

Summary

Certain Yealink products use a default 8-digit numeric PSK when the Wi-Fi AP function is enabled. Attackers can brute-force it to gain network access and intercept Wi-Fi traffic.

Affected when

  • Wi-Fi AP function enabled
  • default 8-digit numeric PSK in use

What to do

Update to the fixed version for your product: AVHub 153.135.0.76, UVC86 151.435.0.66, SmartVision 80 321.435.0.86, UVC40 E2 319.410.0.66, MeetingBorard C 328.321.0.40, MeetingBar A10 278.320.0.86, MeetingBar A40 289.320.0.81, MeetingBar A50 323.320.0.54 or later.

Update to at least the version for your product:

  • Yealink AVHub 153.135.0.76 or later
  • Yealink UVC86 151.435.0.66 or later
  • Yealink SmartVision 80 321.435.0.86 or later
  • Yealink UVC40 E2 319.410.0.66 or later
  • Yealink MeetingBorard C 328.321.0.40 or later
  • Yealink MeetingBar A10 278.320.0.86 or later
  • Yealink MeetingBar A40 289.320.0.81 or later
  • Yealink MeetingBar A50 323.320.0.54 or later

Update these devices now.

  • Yealink AVHub
  • Yealink MeetingBar A10
  • Yealink MeetingBar A40
  • Yealink MeetingBar A50
  • Yealink MeetingBorard C
  • Yealink SmartVision 80
  • Yealink UVC40 E2
  • Yealink UVC86

Fixed in version 153.135.0.76.

Products and platforms

  • Yealink AVHub
  • Yealink MeetingBar A10
  • Yealink MeetingBar A40
  • Yealink MeetingBar A50
  • Yealink MeetingBorard C
  • Yealink SmartVision 80
  • Yealink UVC40 E2
  • Yealink UVC86

CVE IDs

Sources

Times

First published

First seen