CVE-2024-31747 identifies a vulnerability in the Yealink VP59 Microsoft Teams Phone firmware version 91.15.0.118, where an attacker with physical proximity can disable the phone's lock mechanism by exploiting the Walkie Talkie menu option. This vulnerability does not require prior authentication but does require user interaction and physical access to the device. The flaw affects the availability aspect of the device by allowing an attacker to bypass the lock screen, potentially enabling unauthorized use of the phone. The vulnerability does not compromise confidentiality or integrity of data. The issue has been addressed in firmware version 122.15.0.142, which users are advised to install. The CVSS v3.1 score is 2.1, reflecting low severity due to the limited attack vector (physical access), low impact on confidentiality and integrity, and the requirement for user interaction. There are no known exploits in the wild at this time. This vulnerability highlights the importance of physical security controls and timely patch management for VoIP devices in enterprise environments.

The primary impact of this vulnerability is on the availability and physical security of the Yealink VP59 Teams Phone devices. An attacker with physical access can disable the phone lock, potentially allowing unauthorized use of the device, which could lead to misuse of telephony services or unauthorized calls. Although this does not directly compromise sensitive data or system integrity, it could facilitate social engineering or other attacks by impersonating legitimate users. Organizations relying heavily on these devices for communication, especially in secure or sensitive environments, may face operational disruptions or reputational risks. The low CVSS score indicates limited risk, but environments with lax physical security controls are more vulnerable. Since no exploits are known in the wild, the immediate threat is low but should not be ignored.

1. Upgrade all Yealink VP59 Microsoft Teams Phones to firmware version 122.15.0.142 or later, which contains the fix for this vulnerability. 2. Implement strict physical security controls to prevent unauthorized physical access to VoIP devices, including secure office environments and locked rooms. 3. Disable or restrict access to the Walkie Talkie menu option if it is not required for business operations. 4. Regularly audit device configurations and access logs to detect any unauthorized usage. 5. Educate staff about the risks of physical device tampering and encourage reporting of suspicious activity. 6. Consider network segmentation for VoIP devices to limit potential lateral movement if a device is compromised. 7. Maintain an up-to-date inventory of all VoIP devices and their firmware versions to ensure timely patching.