CVE-2019-14656: Yeahlink t49g Firmware

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.

Affected products

• Yeahlink t49g Firmware: up to and including 2019-08-04
• Yeahlink t58v Firmware: up to and including 2019-08-04
• Yeahlink VP59 Firmware: up to and including 2019-08-04

Published 2019-10-08. Last modified 2026-06-17.