This vulnerability is an unauthorized file write flaw that can be triggered under specific conditions in Yealink Plug‑in Softwares before version 2.35.219.0. By writing arbitrary malicious files into the system, an attacker can later execute those files, resulting in full remote code execution. The weakness is identified as CWE-434. The potential impact includes loss of confidentiality, integrity, and availability, as the attacker can gain unrestricted control over the affected device.

Yealink Plug‑in Softwares running any release prior to version 2.35.219.0 are impacted. Systems that rely on the plug‑in package for voice or video communication may be compromised if the vulnerable component is present.

The CVSS score of 9 indicates a critical severity level. Because the exploit capitalizes on an unauthorized file write, it can potentially be executed remotely without user interaction once the attacker has a foothold (inferred). The likely attack vector is through a remote interface, such as a web interface or API exposed by the plug‑in, inferred from the nature of the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS and the ability to achieve code execution without local access make it a high‑risk threat if unpatched.