CISA is reporting this Yealink Vulnerability: Improper Restriction of Excessive Authentication Attempts, Allocation of Resources Without Limits or Throttling, Incorrect Authorization, Improper Certificate Validation
Thank you for raising the CISA report regarding vulnerabilities in Yealink’s devices firmware and provisioning infrastructure.
To clarify, these are vendor-side issues rooted in Yealink’s own design and certificate practices, which lie entirely outside 3CX's control.
Regarding affected devices:
For supported Yealink models (T23G, T53, T53W, T54W, T57W), the firmware versions currently deployed via 3CX are not impacted.
All others models identified in the report are legacy/EOL, we’ve already contacted Yealink multiple times to request validated firmwares. While no updated images have been provided yet, we’re monitoring the situation and will reassess support for those models as needed. Please note that for EOL hardware, firmware is only deployed if a vendor explicitly provides and requests integration. A simple mitigation here is to use 3CX Apps instead of these devices.
Regarding Yealink RPS, 3CX has already safeguards to mitigate exposure :
The PBX sends provisioning instructions only to the 3CX RPS gateway, not directly to Yealink — this intermediary model gives us tighter oversight.
Provisioning URLs are secured by short-lived, one-time credentials, which auto-expire after successful use or if unused.
The 3CX RPS gateway also performs automated cleanup of records on Yealink’s RPS, ensuring no stale credentials remain (unlike many PBX vendors).
All provisioning actions are logged with timestamps and source IPs, and are subject to the same blacklist/whitelist enforcement as all other inbound PBX traffic.
In short, we recommend all the community contacting Yealink directly for device-level mitigations and firmware status so they address this matter with priority and provide us with new firmware in a timely manner. Meanwhile, 3CX’s provisioning design and control layers significantly reduce the practical risk of exploitation — based on deliberate architectural decisions made well before this disclosure.
We remain at your disposal for any further assistance.
