CVE-2026-7208

Name of the Vulnerable Software and Affected Versions Yealink SIP-T33G versions prior to 124.87.0.0

Description Authenticated attackers can exploit a race condition—a situation where the system's behavior depends on the sequence or timing of uncontrollable events—to interrupt active diagnostic processes. By triggering a diagnostic operation, such as ping or traceroute, and simultaneously invoking the file deletion endpoint, an attacker can delete output files written to predictable paths within the diagnostic directory. This action terminates the running process and can leave the system in an inconsistent state.

Recommendations Update to version 124.87.0.0 or later.