CVE-2025-68644

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances.

Score

CVSS 3.1 7.4 High

Status

Deferred - cve@mitre.org

Published

2025-12-21

Last modified

2026-10-19

Weaknesses

CWE-290

Affected products

• Rps (Yealink)

References

• https://www.yealink.com/en/trust-center/security-bulletins/yealink-unauthorized-access-to-rps-vulnerability
• https://www.yealink.com/website-service/download/Yealink_RPS_Security_Remediation_Verification_Report.pdf