EIP-2026-102130

PRE-CVE

YeaLink IP Phone Firmware 9.70.0.100 - Phone Call

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102130. PoCs published by b0rh.

AI-analyzed exploit summary This exploit leverages an authentication bypass vulnerability in YeaLink IP Phone SIP-TxxP firmware <=9.70.0.100 to initiate unauthorized phone calls. It sends a crafted HTTP request to the phone's CGI interface, bypassing user confirmation.

Description

YeaLink IP Phone Firmware 9.70.0.100 - Phone Call

Exploits (1)

exploitdb WORKING POC
by b0rh · pythonwebappshardware
https://www.exploit-db.com/exploits/25811

This exploit leverages an authentication bypass vulnerability in YeaLink IP Phone SIP-TxxP firmware <=9.70.0.100 to initiate unauthorized phone calls. It sends a crafted HTTP request to the phone's CGI interface, bypassing user confirmation.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: YeaLink IP Phone SIP-TxxP firmware <=9.70.0.100
Auth required
Prerequisites: Network access to the target IP phone · Default or known credentials (user/user)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026