EUVD-2026-77476
GHSA-879f-v6cp-q665
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authentication (PR:L), a timing race (AC:H), and impacts only availability with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.
AnalysisAI
Race condition in Yealink SIP-T33G firmware versions 124.86.x.x allows authenticated network users to abort active diagnostic operations by exploiting unsynchronized access to predictable output file paths. An attacker with low-level device credentials triggers a diagnostic tool such as ping or traceroute, then concurrently invokes the file deletion endpoint to remove the output file while it is being written, interrupting the running process and leaving the device in an inconsistent state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid user account on the Yealink SIP-T33G web management interface (PR:L - at minimum low-privilege authenticated access). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.0 (Medium) and the vector AV:N/AC:H/PR:L/UI:N/VC:N/VI:N/VA:H accurately capture the bounded real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Yealink SIP-T33G firmware to version 124.87.0.0 or later, as documented in the vendor security bulletin at https://www.yealink.com/en/trust-center/security-bulletins/race-condition-on-runtime-diagnostic-files-in-yealink-sipt33g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today