CVE-2025-52918

Executive Summary

CVE-2025-52918 is a security advisory affecting Yealink RPS (Redirection and Provisioning Server) prior to 2025-05-26. The vulnerability allows unauthorized access to OpenAPI interfaces by frozen enterprise accounts. This means that even after an enterprise account has been deactivated or frozen, its associated API tokens or session remain valid for accessing the RPS OpenAPI endpoints. The CVSS score is 5.0 (Medium), with a low confidentiality impact and no impact on integrity or availability. No public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time. The patch status is unknown, and no official patch details have been released by Yealink.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – The attacker does not need any authentication or privileges.
• User Interaction: None (UI:N) – No user action is required for exploitation.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure is possible.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service is possible.

Threat Level: Medium. The vulnerability allows unauthorized access to OpenAPI endpoints, potentially exposing sensitive provisioning data or configuration details. However, the lack of public exploit code and low EPSS score reduce immediate risk.

Deep Dive & Mechanics

The Yealink RPS is a cloud-based provisioning server used to manage and redirect Yealink devices (phones, DECT, etc.) to their correct provisioning servers. It exposes OpenAPI interfaces for enterprise account management and device provisioning.

The core issue is that the RPS does not properly validate the status of enterprise accounts when processing OpenAPI requests. When an enterprise account is frozen (e.g., due to non-payment, administrative action, or security incident), the system should revoke all API tokens and deny access to all endpoints. However, due to a missing or incomplete authorization check, frozen accounts can still access OpenAPI interfaces.

Attack Scenario:

1. An attacker obtains valid API credentials for a Yealink RPS enterprise account (e.g., through credential stuffing, phishing, or a previous breach).
2. The enterprise account is subsequently frozen by the administrator.
3. Despite the frozen status, the attacker can still use the old API credentials to make requests to the RPS OpenAPI endpoints.
4. The attacker can enumerate devices, retrieve provisioning URLs, or modify provisioning settings (if the API allows), leading to information disclosure or potential device compromise.

Root Cause: The vulnerability is a Missing Authorization (CWE-862) flaw. The RPS fails to check the account_status field (or equivalent) before granting access to OpenAPI endpoints. The authorization logic likely only checks token validity, not account state.

Vulnerable vs. Patched Code

Since no patch details are available, we can only hypothesize the fix.

Vulnerable Code (Pseudocode):

def handle_openapi_request(request):
    token = request.headers.get('Authorization')
    account = verify_token(token)
    if account:
        # Missing check: if account.status == 'frozen': return 403
        return process_request(request)
    else:
        return 401 Unauthorized

Patched Code (Hypothetical):

def handle_openapi_request(request):
    token = request.headers.get('Authorization')
    account = verify_token(token)
    if account and account.status == 'active':
        return process_request(request)
    elif account and account.status == 'frozen':
        return 403 Forbidden, "Account is frozen"
    else:
        return 401 Unauthorized

The fix would involve adding a status check after token verification to ensure only active accounts can access the API.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate unauthorized access to Yealink RPS OpenAPI endpoints using a frozen account.

Prerequisites:

• A valid API token for a Yealink RPS enterprise account (obtained legitimately or through a simulated compromise).
• The ability to freeze the account (simulated in lab).

Steps:

1. Obtain API token: POST /api/v1/auth/login with valid credentials.
2. Freeze the account (simulated via admin panel or database modification).
3. Use the old token to access OpenAPI endpoints:

   curl -H "Authorization: Bearer <old_token>" https://rps.yealink.com/api/v1/devices
   

4. Observe that the request succeeds despite the account being frozen.

Expected Result: The attacker can still list devices, retrieve provisioning URLs, or perform other API actions.

Blue Team

Detection:

• Monitor for API requests from accounts that have been recently frozen or deactivated.
• Alert on any API activity from accounts with status frozen or suspended.
• Implement logging of account status changes and correlate with API access logs.

Mitigation:

• Apply the vendor patch as soon as it becomes available.
• Implement additional authorization checks at the API gateway level (e.g., using a reverse proxy or WAF) to block requests from frozen accounts.
• Regularly audit API access logs for anomalous activity.

Indicators of Compromise (IOCs)

• API Tokens: Tokens issued to accounts that are later frozen but still valid.
• Log Entries: Successful API requests from accounts with status=frozen in the authentication database.
• Network Traffic: HTTP requests to *.yealink.com or rps.yealink.com with valid Bearer tokens from accounts that should be deactivated.
• Timing: API activity from an account after its freeze timestamp.

Detection Engineering

YARA Rule

rule CVE_2025_52918_Yealink_RPS_Frozen_Account {
    meta:
        description = "Detects Yealink RPS API responses indicating frozen account access"
        author = "Valters IT"
        date = "2025-05-26"
        reference = "CVE-2025-52918"
    strings:
        $frozen_response = "account_frozen" ascii wide nocase
        $api_endpoint = "/api/v1/" ascii wide nocase
    condition:
        $api_endpoint and $frozen_response
}

Sigma Rule

title: Yealink RPS Frozen Account API Access
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects successful API requests to Yealink RPS from frozen accounts
author: Valters IT
date: 2025/05/26
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52918
logsource:
    category: web
    product: yealink_rps
detection:
    selection:
        http.response.status_code: 200
        http.url|contains: "/api/v1/"
        http.request.headers.authorization|contains: "Bearer"
    condition: selection
falsepositives:
    - Legitimate API usage from active accounts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52918 Yealink RPS Frozen Account Access"; flow:to_server; content:"/api/v1/"; http_uri; content:"Authorization|3a 20|Bearer"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Freeze API Tokens: Manually revoke all API tokens for frozen accounts via the Yealink RPS admin panel.
2. Monitor Logs: Review access logs for any unauthorized API calls from frozen accounts.
3. Implement Workaround: If possible, add a reverse proxy or API gateway that checks account status before forwarding requests to the RPS backend.

Long-Term Fix:

• Apply the official patch from Yealink once released.
• Update the RPS authorization logic to include account status checks.
• Conduct a security audit of all OpenAPI endpoints to ensure proper authorization.

Vendor Contact: Yealink has not yet released a patch. Monitor their security advisories at https://www.yealink.com.

Valters IT