Yealink RPS Vulnerabilities: Private Key Leak, Auth Bypass, Enumeration

Key Vulnerability Information 1. Yealink RPS Vulnerabilities Description: Yealink RPS (Redirection and Provisioning Service) contains multiple vulnerabilities that could lead to PII exposure or MITM attacks. Impact Scope: Some vulnerabilities are still within the manufacturer’s 60-day disclosure window. 2. Private Key Access Description: Researchers were able to access the private key of the Yealink Equipment Issuing CA, enabling access to RPS servers and retrieval of highly sensitive data. Data Exposure: Includes sensitive information such as configuration URLs, credentials, and pre-shared keys. 3. Vulnerability Status Remediation Status: Yealink claims some vulnerabilities have been patched, but researchers found certain flaws still exist after testing. Severity Classification: Yealink classifies the vulnerabilities as “medium” or “high,” but has not disclosed all details publicly. 4. Firmware Encryption Description: Yealink released new firmware to mitigate the private key leakage issue, but researchers were still able to decrypt the firmware. Impact: The new AES key may improve security, but the actual effectiveness remains unknown. 5. Input Validation Missing Description: RPS does not validate whether device certificates are valid; it only checks file size and extension. Risk: Random data can be uploaded to the RPS service and returned as-is. 6. Serial Number Enumeration Description: The last 5 digits (PIN) of Yealink device serial numbers can be enumerated. Protection Measures: No rate limiting or brute-force protection is in place. 7. MAC Address Enumeration Description: Registered MAC addresses can be enumerated via the RPS API. Impact: Device configurations across global organizations can be rapidly enumerated. 8. Authentication Bypass Description: Previous research revealed authentication bypass vulnerabilities in the RPS API; although Yealink blocked the researchers’ accounts, the bypass mechanism remains accessible to blocked entities. 9. Mitigation Complexity Description: Providing a complete mitigation path may increase the attack surface; additional measures such as email-based code delivery are recommended. 10. Layered Security Description: When a single security layer fails, other layers should provide additional protection to enhance overall security. ``` These key points summarize the main aspects of the Yealink Cloud vulnerabilities, including vulnerability types, impact scope, remediation status, and potential risks and mitigation strategies.

Goal Reached Thanks to every supporter — we hit 100%!

Yealink RPS Vulnerabilities: Private Key Leak, Auth Bypass, Enumeration

More from this source