CVE-2024-30939

Executive Summary

CVE-2024-30939 describes a security flaw in the Yealink VP59 Teams Edition phone running firmware version 91.15.0.118. The vulnerability allows a physically proximate attacker to gain unauthorized control of an account by exploiting a flaw in the factory reset procedure. This is a physical access attack vector, meaning the attacker must have direct physical access to the device. The lack of a CVSS score and patch status indicates that this vulnerability is not yet fully analyzed or addressed by the vendor. The impact is high for organizations relying on these devices for secure communications, as an attacker could potentially intercept calls, access credentials, or pivot to other network resources.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a hardware/firmware issue specific to Yealink devices.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Physical (The attacker must have physical access to the device)
• Attack Complexity (AC): Low (The factory reset procedure is a standard, documented process)
• Privileges Required (PR): None (The attacker does not need prior access)
• User Interaction (UI): None (The attacker can perform the reset without user interaction)
• Scope (S): Changed (The attacker can gain control of an account, potentially affecting other systems)
• Confidentiality (C): High (Potential access to call logs, contacts, and credentials)
• Integrity (I): High (Attacker can modify device settings and potentially impersonate the user)
• Availability (A): Low (The device remains functional, but the attacker controls it)

Threat Level: High (for physical access scenarios). The vulnerability is trivial to exploit if an attacker gains physical proximity.

Deep Dive & Mechanics

The vulnerability lies in the factory reset procedure of the Yealink VP59 Teams Edition. When a factory reset is performed, the device should completely wipe all user data and settings, returning it to an out-of-box state. However, due to a flaw in firmware version 91.15.0.118, the reset process does not properly invalidate the existing Teams account credentials or session tokens. This allows an attacker who performs a physical factory reset to then re-provision the device and gain access to the previously associated Teams account.

Attack Flow:

1. Physical Access: The attacker gains physical access to a Yealink VP59 phone.
2. Factory Reset: The attacker performs a factory reset using the device's hardware buttons or menu.
3. Re-provisioning: After the reset, the device boots up in a setup mode. The attacker can then re-enter the credentials for the same Teams account (or use cached credentials that were not properly cleared).
4. Account Takeover: The attacker now has full control of the Teams account on that device, including the ability to make/receive calls, access contacts, and potentially change settings.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code is within the factory reset logic of the firmware. A patched version would need to ensure that during a factory reset:

• All cached credentials and session tokens are securely deleted.
• The device's association with the Teams account is fully revoked.
• The device cannot be re-provisioned with the same account without proper authentication.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Physical access to a Yealink VP59 Teams Edition phone running firmware 91.15.0.118.
• Knowledge of the device's factory reset procedure (usually holding down a specific button during boot or navigating to Settings > Advanced > Reset).

Steps:

1. Power on the device or ensure it is in an idle state.
2. Perform a factory reset. For example, on many Yealink models, you can press and hold the "OK" button while powering on the device.
3. Wait for the device to reboot and enter the initial setup wizard.
4. Follow the on-screen prompts to re-provision the device. If the device prompts for a Teams account, enter the credentials of the target user (if known) or attempt to use any cached credentials that were not cleared.
5. Once provisioned, the attacker will have full control of the Teams account on that device.

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Prevention)

Prevention:

• Physical Security: Implement strict physical access controls to areas where Yealink phones are deployed. Use locked offices, server rooms, or secure enclosures.
• Device Hardening: Disable the physical factory reset button if possible via device management policies. Use Yealink's device management platform to enforce a policy that requires a PIN or administrator password to perform a factory reset.
• Account Monitoring: Monitor for unusual account activity, such as a device being re-provisioned multiple times or from an unexpected location.

Detection:

• Log Analysis: Monitor device logs for factory reset events. Correlate these with physical access logs (e.g., badge swipes) to identify unauthorized resets.
• Network Anomalies: Look for devices that suddenly appear as new on the network after a reset, or that are re-authenticating to Teams with the same credentials from a different MAC address (if the device's MAC changes after reset).
• User Reports: Train users to report any unusual behavior on their phones, such as unexpected prompts or settings changes.

Indicators of Compromise (IOCs)

• Device Event: Factory reset event logged on the Yealink device.
• Network Traffic: Unusual provisioning traffic from the device to Teams servers after a reset.
• Account Activity: Multiple authentication attempts for the same Teams account from the same device within a short time frame.
• Physical Access: Unauthorized physical access to the device's location (e.g., a door alarm triggered during off-hours).

Detection Engineering

YARA Rule

rule CVE_2024_30939_Yealink_Factory_Reset {
    meta:
        description = "Detects potential exploitation of CVE-2024-30939 by identifying factory reset events in Yealink device logs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-30939"
    strings:
        $reset_log = "Factory reset initiated" nocase
        $reset_complete = "Factory reset completed" nocase
        $teams_provision = "Teams provisioning started" nocase
    condition:
        any of ($reset_log) and any of ($teams_provision)
}

Sigma Rule

title: Yealink Factory Reset Followed by Teams Provisioning
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects a factory reset event on a Yealink device followed by a Teams provisioning attempt, indicating potential exploitation of CVE-2024-30939.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30939
logsource:
    product: yealink
    service: device_logs
detection:
    selection_reset:
        EventID: 1001  # Example: Factory reset event ID
        EventType: 'Factory Reset'
    selection_provision:
        EventID: 2001  # Example: Teams provisioning event ID
        EventType: 'Teams Provisioning'
    condition: selection_reset and selection_provision
falsepositives:
    - Legitimate factory reset by an authorized administrator
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-30939 Yealink Teams Re-provisioning After Factory Reset"; flow:to_server,established; content:"POST"; http_method; content:"/provision"; http_uri; content:"teams"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Devices: If possible, isolate Yealink VP59 devices from sensitive network segments until a patch is available.
2. Physical Controls: Restrict physical access to the devices. Implement a policy that requires two-person integrity for any physical interaction with the phones.
3. Monitor Logs: Enable and monitor device logs for factory reset events. Set up alerts for any reset activity.

Long-Term Actions:

1. Vendor Patch: Contact Yealink support and request a firmware update that addresses this vulnerability. Monitor Yealink's security advisory page for updates.
2. Device Replacement: Consider replacing the VP59 Teams Edition with a model that has a more secure factory reset process or that supports remote management to disable physical reset.
3. Policy Update: Update your organization's security policy to require that any device that undergoes a factory reset must be re-provisioned by an administrator, not by the end user.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact security@valters-it.com.