CVE-2025-68644

Executive Summary

CVE-2025-68644 is an information disclosure vulnerability in the Yealink RPS (Redirection and Provisioning Service) that allows unauthorized access to sensitive data, including AutoP URL addresses. The vulnerability was discovered and remediated by Yealink on June 27, 2025, through a security update that deployed an enhanced authentication mechanism to all cloud instances. The CVSS score of 7.4 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required) and the high confidentiality impact. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating a low probability of active exploitation in the wild. However, the exposure of AutoP URLs could lead to further attacks against provisioned devices.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects Yealink’s cloud-based RPS infrastructure, which is a proprietary service used for provisioning Yealink devices.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.4 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit the vulnerability.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerability does not affect resources beyond the RPS service.
• Confidentiality Impact: High (C:H) – Unauthorized access to AutoP URLs and potentially other sensitive information.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – The service remains available.

Threat Level: High. The vulnerability is trivial to exploit (no authentication, low complexity) and exposes sensitive provisioning data that could be used to compromise Yealink devices.

Deep Dive & Mechanics

The Yealink RPS is a cloud-based service used to automatically provision Yealink IP phones and other devices. It stores configuration profiles, firmware URLs, and AutoP (Auto Provisioning) URLs that devices use to download their settings. The vulnerability allowed an unauthenticated attacker to query the RPS API and retrieve these AutoP URLs without proper authorization.

Root Cause: The RPS API endpoints lacked proper authentication checks for certain information retrieval operations. Specifically, the service did not validate that the requesting entity was authorized to access the provisioning data associated with a given device or account.

Attack Vector: An attacker could send crafted HTTP requests to the RPS API (e.g., https://rps.yealink.com/api/v1/device/info?mac=XX:XX:XX:XX:XX:XX) and receive the AutoP URL and other provisioning details in the response. The MAC address could be guessed, brute-forced, or obtained from other sources (e.g., network scans, public directories).

Impact: With the AutoP URL, an attacker could:

• Download the provisioning configuration file, which may contain SIP credentials, network settings, and other sensitive data.
• Modify the configuration (if the URL points to a writable location) to redirect devices to a malicious server.
• Perform device fingerprinting and inventory attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable RPS API endpoint (pre-patch)
@app.route('/api/v1/device/info')
def get_device_info():
    mac = request.args.get('mac')
    # No authentication check
    device = db.query("SELECT * FROM devices WHERE mac = ?", mac)
    return jsonify(device)

Patched Code (Conceptual):

# Patched RPS API endpoint (post-patch)
@app.route('/api/v1/device/info')
@requires_auth  # New authentication decorator
def get_device_info():
    mac = request.args.get('mac')
    user = get_current_user()
    if not user.is_authorized_for_device(mac):
        abort(403)
    device = db.query("SELECT * FROM devices WHERE mac = ?", mac)
    return jsonify(device)

The patch introduces an authentication mechanism that verifies the identity of the requester and checks authorization before returning device information. This prevents unauthorized access to AutoP URLs and other sensitive data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the Yealink RPS cloud service (e.g., rps.yealink.com).
• A valid or guessable MAC address of a Yealink device.

Exploitation Steps:

1. Identify the RPS API endpoint (e.g., via documentation or reverse engineering).
2. Send a GET request to the endpoint with a MAC address parameter.
3. Parse the response to extract the AutoP URL.

Example Request (using curl):

curl -X GET "https://rps.yealink.com/api/v1/device/info?mac=00:11:22:33:44:55"

Expected Response (vulnerable):

{
  "mac": "00:11:22:33:44:55",
  "autop_url": "http://provisioning.example.com/yealink/00-11-22-33-44-55.cfg",
  "firmware_version": "83.0.0.10",
  "model": "T46S"
}

Automation: A script can iterate through a range of MAC addresses (e.g., OUI prefixes for Yealink) to harvest multiple AutoP URLs.

Blue Team (Defense & Detection)

Defensive Measures:

• Ensure all Yealink RPS cloud instances are updated to the patched version (post-2025-06-27).
• Monitor network traffic for unusual API calls to rps.yealink.com with high frequency or from unexpected IP ranges.
• Implement rate limiting and anomaly detection on RPS API endpoints.
• Use web application firewalls (WAF) to block requests without proper authentication tokens.

Detection Strategy:

• Log all requests to the RPS API and alert on any that return device information without a valid session token.
• Correlate RPS API access with known device MAC addresses to detect unauthorized queries.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to https://rps.yealink.com/api/v1/device/info with a mac parameter.
  • Unusual volume of requests from a single IP address to the RPS API.
  • Requests containing MAC addresses that do not belong to the organization’s devices.

• File IOCs:

  • Log entries showing 200 OK responses from the RPS API for unauthorized requests.
  • Configuration files downloaded from AutoP URLs that were not initiated by legitimate devices.

• Behavioral IOCs:

  • Devices provisioning from unexpected AutoP URLs.
  • Unauthorized changes to device configurations.

Detection Engineering

YARA Rule

rule Detect_Yealink_RPS_Info_Disclosure {
    meta:
        description = "Detects HTTP responses containing Yealink AutoP URLs from RPS API"
        author = "Valters IT"
        date = "2025-07-15"
        cve = "CVE-2025-68644"
    strings:
        $autop_url = /"autop_url"\s*:\s*"http[^"]+/
        $mac_pattern = /"mac"\s*:\s*"([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})"/
        $rps_endpoint = "/api/v1/device/info"
    condition:
        all of them
}

Sigma Rule

title: Yealink RPS Unauthorized Access to AutoP URLs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Yealink RPS API that may indicate exploitation of CVE-2025-68644
author: Valters IT
date: 2025/07/15
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/v1/device/info'
        cs-uri-query|contains: 'mac='
    condition: selection
falsepositives:
    - Legitimate provisioning requests from authorized devices
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68644 Yealink RPS Unauthorized Access Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/v1/device/info"; http_uri; content:"mac="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Cloud Instances: Ensure all Yealink RPS cloud instances have received the security update deployed on 2025-06-27. Contact Yealink support if unsure.
2. Rotate Credentials: If any AutoP URLs were exposed, rotate the credentials and configuration files stored at those URLs.
3. Audit Access Logs: Review RPS API access logs for any unauthorized queries made before the patch date.

Long-Term Mitigations:

• Implement API authentication tokens for all RPS requests.
• Use network segmentation to restrict access to the RPS service.
• Enable logging and monitoring for all provisioning activities.
• Conduct regular security assessments of cloud-based provisioning services.

Workarounds:

• If patching is not immediately possible, restrict network access to the RPS API using firewall rules or VPNs.
• Disable AutoP functionality temporarily and provision devices manually.

Valters IT