CVE-2026-7208

Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

Published Sep 14, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.

Analysis

Technical impact

The vulnerability is a race condition (CWE-362) that allows an authenticated user to terminate running diagnostic processes by deleting output files written to predictable paths, causing diagnostic failures and leaving the device in an inconsistent state.

Affected Systems

Affected devices include Yealink SIP‑T33G IP phones running firmware versions 124.86.x.x or earlier than 124.87.0.0, which contain the race condition.

Risk and Exploitability

The CVSS base score is 6, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the phone and the ability to trigger diagnostic commands while simultaneously invoking the file‑deletion endpoint. Because the attack needs an active session, the risk is limited to compromised devices or trusted users, but the lack of higher severity may reduce urgency; nevertheless, patching is recommended to eliminate the race condition.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Yealink

SIP-T33G

unaffected

Version	Status	Constraints
`124.86.0.0`	affected	< 124.87.0.0

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the device firmware to version 124.87.0.0 or later to remove the race condition.
Disable or restrict access to the diagnostic file‑deletion endpoint to prevent concurrent deletion during diagnostics.
If a firmware update cannot be applied immediately, configure the device to deny or limit concurrent file‑deletion requests from authenticated users while diagnostic operations are in progress.

Generated by OpenCVE AI on September 15, 2026 at 13:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.347% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.vulncheck.com/advisories/yealink-sip-t33g-race-condition-via-diagnostic-file-deletion
https://www.yealink.com/en/product-detail/ip-phone-t33g
https://www.yealink.com/en/trust-center/security-bulletins/race-condition-on-runtime-diagnostic-files-in-yealink-sipt33g

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.
Title		Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion
Weaknesses		CWE-362
References		https://www.vulncheck.com/advisories/yealink-sip-t33g-race-condition-via-diagnostic-file-deletion https://www.yealink.com/en/product-detail/ip-phone-t33g https://www.yealink.com/en/trust-center/security-bulletins/race-condition-on-runtime-diagnostic-files-in-yealink-sipt33g
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`