CVE-2024-31747

Executive Summary

CVE-2024-31747 is a physical access vulnerability in the Yealink VP59 Microsoft Teams Phone running firmware version 91.15.0.118. A physically proximate attacker can disable the phone lock by exploiting the Walkie Talkie menu option. This allows unauthorized access to the device, potentially exposing sensitive communications and configuration data. The vulnerability is fixed in firmware version 122.15.0.142. No public exploit code or Nuclei template is available, but the attack vector is straightforward and requires only physical proximity.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but this is likely due to incomplete data. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Physical (P)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)

Estimated CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Threat Level: Medium (physical access required, but impact is significant)

Deep Dive & Mechanics

The vulnerability resides in the Walkie Talkie feature of the Yealink VP59 Microsoft Teams Phone. When the device is locked, the Walkie Talkie menu option remains accessible. An attacker can navigate to this menu and, through a sequence of actions, disable the phone lock entirely. This bypasses the intended security mechanism that should prevent unauthorized physical access.

The root cause is a missing authorization check (CWE-862) in the Walkie Talkie menu handler. The firmware does not verify whether the device is locked before allowing the user to access and modify lock settings via this menu.

Vulnerable vs. Patched Code

Vulnerable Code (firmware 91.15.0.118):

// In the Walkie Talkie menu handler
void handle_walkie_talkie_menu() {
    // No check for device lock status
    show_walkie_talkie_options();
    // User can navigate to lock settings
    if (user_selects_disable_lock()) {
        disable_device_lock();
    }
}

Patched Code (firmware 122.15.0.142):

// In the Walkie Talkie menu handler
void handle_walkie_talkie_menu() {
    // Check if device is locked
    if (is_device_locked()) {
        show_access_denied_message();
        return;
    }
    show_walkie_talkie_options();
    if (user_selects_disable_lock()) {
        disable_device_lock();
    }
}

The patch adds a simple lock status check before allowing any menu interaction.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to a Yealink VP59 running firmware 91.15.0.118
• The device must be locked (screen locked)

Steps:

1. Approach the device and press the screen to wake it.
2. Tap the "Walkie Talkie" icon on the locked screen.
3. Navigate to the settings menu within Walkie Talkie.
4. Select "Disable Lock" or similar option.
5. The device lock is now disabled, granting full access.

Proof of Concept (No exploit code available):

# No automated exploit exists; manual steps as above.

Blue Team

Detection:

• Monitor for repeated failed unlock attempts followed by successful access.
• Check device logs for "Walkie Talkie" menu access during locked state.
• Use physical security cameras to monitor device access.

Prevention:

• Apply firmware update 122.15.0.142 immediately.
• Restrict physical access to devices.
• Enable additional authentication (e.g., PIN) for sensitive menu options.

Indicators of Compromise (IOCs)

• Device Logs: Entries showing "Walkie Talkie" menu accessed while device was locked.
• Firmware Version: 91.15.0.118 (vulnerable)
• Physical Evidence: Unusual screen activity or unlocked device when unattended.

Detection Engineering

YARA Rule

rule CVE_2024_31747_Yealink_Lock_Bypass {
    meta:
        description = "Detects Yealink VP59 firmware vulnerable to CVE-2024-31747"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-31747"
    strings:
        $firmware_version = "91.15.0.118"
        $walkie_talkie = "Walkie Talkie"
    condition:
        $firmware_version and $walkie_talkie
}

Sigma Rule

title: Yealink VP59 Lock Bypass via Walkie Talkie
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to Walkie Talkie menu on locked Yealink VP59
logsource:
    product: yealink
    service: device_logs
detection:
    selection:
        EventID: 1001
        Menu: "Walkie Talkie"
        DeviceLocked: true
    condition: selection
falsepositives:
    - Legitimate use if device is unlocked
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-31747 Yealink VP59 Lock Bypass"; flow:to_server; content:"Walkie Talkie"; nocase; content:"disable lock"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update firmware to version 122.15.0.142 or later.
• If update cannot be applied, disable the Walkie Talkie feature via device management.

Long-term:

• Implement physical security controls (e.g., locked rooms, camera surveillance).
• Regularly audit device firmware versions.
• Enable logging and monitor for suspicious menu access.

Workaround:

• Use a PIN or biometric lock that cannot be bypassed via menu options.

Valters IT