Loading vulnerability…
Command Injection RCE in Yealink T21P_E2 Diagnostic Ping
CVE-2025-66738 is a command-injection vulnerability in Yealink T21P_E2 Phone firmware version 52.84.0.15. A remote attacker holding normal privileges can submit a crafted request to the diagnostic component's ping function and execute arbitrary code.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on the affected Yealink phone. The available information states that the vulnerability poses risk to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until a corrective firmware update is deployed, limit network access to the phone's diagnostic interface to trusted administrative hosts and networks. Disable the diagnostic component if the device supports doing so without unacceptable operational impact.
Patch, then assume compromise.
Update affected Yealink T21P_E2 phones to a firmware release that addresses CVE-2025-66738 when one is available from the vendor. Restrict access to the diagnostic interface and disable the diagnostic component where operationally feasible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.