The Yealink YMCS RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9 cve-icon cve-icon
https://www.yealink.com/en/trust-center/security-advisories/f8205560a8c7443f cve-icon cve-icon
History

Sat, 21 Jun 2025 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:R'}

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Sat, 21 Jun 2025 23:15:00 +0000

Type Values Removed Values Added
Description The Yealink YMCS RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:R'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-06-21T00:00:00.000Z

Updated: 2025-06-21T23:10:26.397Z

Reserved: 2025-06-21T00:00:00.000Z

Link: CVE-2025-52917

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2025-06-21T23:15:24.017

Modified: 2025-06-22T00:15:24.747

Link: CVE-2025-52917

cve-icon Redhat

No data.