Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.

Yealink YMCS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.

The affected products lack serial number verification attempt limits, enabling brute-force enumeration (last five digits). The affected products lack rate limiting, potentially enabling information disclosure via excessive requests. The affected products fail to enforce access restrictions on OpenAPIs for frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. The certificate upload function in the affected products does not properly validate certificate content, potentially allowing invalid certificates to be uploaded.