Vulnerability Description
Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://www.vulncheck.com/advisories/yealink-sip-t33g-race-condition-via-diagnos
- https://www.yealink.com/en/product-detail/ip-phone-t33g
- https://www.yealink.com/en/trust-center/security-bulletins/race-condition-on-run
FAQ
What is CVE-2026-7208?
CVE-2026-7208 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently de...
How severe is CVE-2026-7208?
CVE-2026-7208 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-7208?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.