Yealink RPS CVE-2025-68644

Requires network access to Yealink's RPS (Redirection and Provisioning Service) cloud endpoint and the ability to defeat its pre-fix authentication mechanism (CWE-290 spoofing/bypass) to read provisioning data such as AutoP URL addresses. Exploitation is limited by high attack complexity (AC:H) - success depends on specific, attacker-uncontrolled conditions rather than a simple request - and is now further limited because Yealink deployed an enhanced authentication mechanism to all cloud instances, closing the exposure on the vendor-hosted service as of the 2025-06-27 fix; no customer-side configuration or user interaction is required to exploit, but no customer action was available to mitigate either since the fix is server-side.

This is a genuine but moderate-priority issue whose real-world risk is now largely historical. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N, 7.4 HIGH) describes a network-reachable, unauthenticated flaw with high confidentiality and integrity impact, but with high attack complexity - meaning non-trivial, attacker-uncontrolled conditions must be met to spoof/bypass the RPS authentication (consistent with CWE-290, Authentication Bypass by Spoofing). The EPSS score of 0.30% (22nd percentile) indicates low predicted exploitation likelihood, and there is no CISA KEV listing and no public proof-of-concept, so the signals are internally consistent: a legitimately high-severity flaw that has not translated into observed or likely mass exploitation. Critically, Yealink states the vulnerability was remediated server-side across ALL cloud instances of RPS via a security update (not a customer-applied patch), so the exposure window effectively closed on/after 2025-06-27 for the vendor-hosted service; residual risk applies only if data (e.g., AutoP URLs) was exfiltrated before the fix. The tags and CWE agree with the description. No conflicting signals were identified; the main uncertainty is the exact nature of the AC:H conditions, which neither NVD nor the vendor bulletin detail in the available data.

A remote, unauthenticated attacker interacts with Yealink's RPS (Redirection and Provisioning Service) cloud endpoint and, by defeating the weak authentication mechanism, retrieves provisioning information including AutoP (auto-provisioning) URL addresses. Those URLs can expose device configuration locations, potentially enabling further reconnaissance or tampering of provisioned Yealink phones. No public exploit code is identified, and the high attack complexity suggests exploitation is non-trivial rather than trivially repeatable.