CVE-2019-14657: Yeahlink t49g Firmware

High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days.

Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.

Affected products

• Yeahlink t49g Firmware: up to and including 2019-08-04
• Yeahlink t58v Firmware: up to and including 2019-08-04
• Yeahlink VP59 Firmware: up to and including 2019-08-04

Published 2019-10-08. Last modified 2026-06-17.