CVE-2025-66737: Yealink SIP-t21(p)e2 Firmware

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component.

Affected products

• Yealink SIP-t21(p)e2 Firmware: version 52.84.0.15 only

Published 2025-12-26. Last modified 2026-10-05.