CVE-2021-27561

CVE-2021-27561 is a critical (CVSS 9.8) unauthenticated OS command injection flaw (CWE-78) in Yealink Device Management (DM) 3.6.0.20, which CISA also characterizes as a server-side request forgery issue. A remote attacker can send a crafted, unauthenticated HTTP request to the /sm/api/v1/firewall/zone/services URI to inject operating system commands that execute with root privileges on the DM server. Successful exploitation yields full root control of the management server, allowing an attacker to pivot into the managed VoIP/UC environment, move laterally inside the network, or enroll the host in an IoT-style botnet. The flaw affects organizations running Yealink Device Management to administer fleets of Yealink IP phones, and it is trivially exploitable over the network with no user interaction. It was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and the recent emergence of Mirai-variant botnets targeting network devices is consistent with active mass-scanning for this class of unauthenticated injection flaw; EPSS puts the 30-day exploitation probability at roughly 83%.

What to do: Upgrade Yealink Device Management to a fixed release per Yealink's instructions (the confirmed affected version is 3.6.0.20); CISA's required action is to apply vendor updates. Until patched, restrict access to the DM web interface to trusted management networks and verify it is not internet-exposed. Check access logs for unauthenticated requests to /sm/api/v1/firewall/zone/services, which would indicate probing or exploitation.