CVE-2024-48353

Name of the Vulnerable Software and Affected Versions Yealink Meeting Server versions prior to V26.0.0.67

Description The issue is related to insufficient protection of service data, allowing a remote attacker to gain access to user authentication data. Specifically, attackers can obtain static key information from a front-end JS file and use it to decrypt plaintext passwords.

Recommendations For versions prior to V26.0.0.67, update to version V26.0.0.67 or later to resolve the issue. As a temporary workaround, consider restricting access to the front-end JS file to minimize the risk of exploitation.