High severity8.8NVD Advisory· Published Oct 8, 2019· Updated Jun 17, 2026

CVE-2019-14657

Description

Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.

Affected products

Yeahlink/T49g Firmware
cpe:2.3:o:yeahlink:t49g_firmware:*:*:*:*:*:*:*:*
Range: <=2019-08-04
Yeahlink/T58v Firmware
cpe:2.3:o:yeahlink:t58v_firmware:*:*:*:*:*:*:*:*
Range: <=2019-08-04
Yeahlink/Vp59 Firmware
cpe:2.3:o:yeahlink:vp59_firmware:*:*:*:*:*:*:*:*
Range: <=2019-08-04
Yealink/phonesdescription
Yealink/phonesllm-create
Range: <=2019-08-04

Patches

Vulnerability mechanics

References

cerebusforensics.com/yealink/exploit.htmlnvdExploitThird Party Advisory
sway.office.com/3pCb559LYVuT0eignvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000