CVE-2024-28442: Yealink VP59 v · Directory Traversal
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 12:54 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 26 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-28442 effectively, organizations should implement the following specific measures: 1) Restrict physical access to Yealink VP59 devices to trusted personnel only, preventing unauthorized local network connections. 2) Segment the network to isolate IP phones from general user networks and untrusted devices, limiting attacker proximity. 3) Disable or restrict access to the company portal and terms of use function if not essential, reducing the attack surface. 4) Monitor network traffic to and from Yealink devices for unusual access patterns or attempts to access unauthorized file paths. 5) Employ network access controls such as MAC filtering or 802.1X authentication to limit device connectivity. 6) Regularly audit device configurations and logs for signs of compromise or exploitation attempts. 7) Engage with Yealink support or vendors for firmware updates or patches addressing this vulnerability and apply them promptly once available. 8) Educate IT and security teams about this vulnerability to ensure rapid detection and response. These targeted actions go beyond generic advice by focusing on access control, monitoring, and configuration hardening specific to the affected devices and vulnerability vector.
Description
Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use function in the company portal component.