CVE-2025-52917

Published: Jun 21, 2025Modified: Jun 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/

Source: cve@mitre.org

https://seclists.org/fulldisclosure/2025/Jun/20

Source: cve@mitre.org

https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9

Source: cve@mitre.org

https://www.yealink.com/en/trust-center/security-advisories/f8205560a8c7443f

Source: cve@mitre.org

Timeline

No history available yet.