Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1735: Yealink MeetingBar A30 133.321.0.3: Command Injection Risk

CVE-2026-1735 · published 9 months ago

Summary

A security weakness in Yealink MeetingBar A30 version 133.321.0.3 allows a hacker to potentially inject malicious commands into the device, which could be used to take control of the device. This vulnerability can be exploited by an attacker with physical access to the device. Users are advised to update their software or contact Yealink for assistance.

Original advisory text

A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

0.9 Low

Exploitation

1% chance of attack within 30 days

Type

CWE-74Injection

CWE-77Command Injection

Timeline

Published2 Feb 2026

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2026-1735 · NVD

Track software like this

Free during beta