CVE-2021-27561
Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2021-27561 is a critical command injection vulnerability in Yealink Device Management (DM) version 3.6.0.20 and earlier. The vulnerability exists in the /sm/api/v1/firewall/zone/services URI, which allows unauthenticated attackers to inject and execute arbitrary operating system commands as root without any authentication. This CVE-2021-27561 vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With a CVSS score of 9.8 (CRITICAL) and an EPSS score of 94.11% (99.9th percentile), this command injection flaw in the Yealink Device Management platform poses an extreme risk to organizations using this enterprise phone management solution.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| yealink | device management | <= 3.6.0.20 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://ssd-disclosure.com/?p=4688(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27561(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
The Yealink Device Management platform fails to properly neutralize special elements in user input received through the firewall zone services API before incorporating it into operating system commands. Since the API endpoint requires no authentication, any remote attacker with network access can inject shell metacharacters to execute arbitrary commands with root privileges on the underlying server, leading to complete system compromise.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
Impact Analysis
CVE-2021-27561 carries the near-maximum CVSS 3.1 score of 9.8 (CRITICAL), reflecting the extreme severity of this vulnerability. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker with network access to the Yealink Device Management platform. Confidentiality (High): root-level command execution allows complete access to all data on the system, including device credentials, configuration data, and potentially VoIP call records. Integrity (High): arbitrary commands can modify system files, install backdoors, and alter device management configurations. Availability (High): attackers can disrupt the entire phone management infrastructure, affecting all managed Yealink devices. The EPSS score of 94.11% (99.9th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-27561 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with an urgent remediation deadline of 2021-11-17 (only two weeks after listing). The EPSS score of 94.11% (99.9th percentile) indicates near-certain exploitation activity. While no public proof-of-concept exploit was identified in the immediate references, the vulnerability details were disclosed by SSD Disclosure, providing sufficient technical information for attackers to develop exploits. The combination of unauthenticated access, root-level command execution, and a simple API endpoint makes this vulnerability extremely attractive to threat actors targeting enterprise communication infrastructure.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. The Yealink Device Management platform must be updated beyond version 3.6.0.20 to a patched release.
- If immediate patching is not feasible, restrict network access to the Yealink Device Management platform using firewall rules. The management interface should only be accessible from trusted administrative networks and should never be exposed to the internet.
- Block access to the vulnerable API endpoint /sm/api/v1/firewall/zone/services at the network level using a WAF or reverse proxy until patches can be applied. Implement input validation rules that reject requests containing shell metacharacters.
- Conduct a thorough compromise assessment on systems running Yealink Device Management: review system logs for unexpected command execution, check for unauthorized user accounts or SSH keys, inspect running processes for suspicious activity, and audit managed device configurations for unauthorized changes.
- As a long-term measure, segment the device management platform from the rest of the network, implement strict access controls, and monitor the API for anomalous request patterns. Ensure the management platform does not run with root privileges where possible.
Technical Details
CVE-2021-27561 is an OS command injection vulnerability (CWE-78) in the Yealink Device Management (DM) platform version 3.6.0.20. The vulnerability resides in the /sm/api/v1/firewall/zone/services API endpoint, which does not require any authentication and fails to sanitize user-supplied input before passing it to the operating system shell. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack requires no privileges and no user interaction, with maximum impact across confidentiality, integrity, and availability. The injected commands execute with root privileges, providing the attacker with the highest level of access to the underlying system. The combination of an unauthenticated API endpoint and root-level command execution makes this one of the most dangerous variants of OS command injection, as it provides immediate, unrestricted access to the target system from a single HTTP request.
Frequently Asked Questions
Is CVE-2021-27561 being actively exploited?
Yes. CVE-2021-27561 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.11% (99.9th percentile) indicates near-certain exploitation activity. CISA set an urgent remediation deadline of 2021-11-17, only two weeks after adding this vulnerability to the catalog.
What products are affected by CVE-2021-27561?
CVE-2021-27561 affects Yealink Device Management (DM) version 3.6.0.20 and potentially earlier versions. This platform is used for centralized management and provisioning of Yealink IP phones and communication devices in enterprise environments.
How do I fix CVE-2021-27561?
Update the Yealink Device Management platform to a version beyond 3.6.0.20 that addresses this vulnerability. As an immediate mitigation, restrict network access to the management platform and block requests to the /sm/api/v1/firewall/zone/services endpoint. See the Remediation section for complete steps.
How severe is CVE-2021-27561?
CVE-2021-27561 has a CVSS 3.1 score of 9.8 (CRITICAL). The vulnerability allows unauthenticated remote command execution with root privileges, making it one of the most severe types of security flaws. With an EPSS score in the 99.9th percentile, immediate remediation is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.