CVE-2024-48352 affects Yealink Meeting Server before version 26.0.0.67. The vulnerability allows an unauthenticated attacker to cause sensitive data exposure by sending an HTTP request with an enterprise ID to the server. The flaw is categorized under CWE-922 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a failure to properly restrict access to sensitive data in server responses. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high impact on confidentiality but no impact on integrity or availability.

An attacker can obtain sensitive information from the server response without authentication or user interaction, potentially leading to information disclosure that could aid further attacks or compromise privacy. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Yealink's official channels for updates and apply any forthcoming patches promptly. Until a patch is available, restrict access to the affected server and monitor for suspicious HTTP requests containing enterprise IDs.