CVE-2025-66738: Yealink SIP-t21(p)e2 Firmware

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.

Affected products

• Yealink SIP-t21(p)e2 Firmware: version 52.84.0.15 only

Published 2025-12-26. Last modified 2026-10-07.