Race Condition on Runtime Diagnostic Files in #Yealink SIP‑T33G + Yealink IP Phone Directory Traversal Vulnerability = High-privs arbitrary file-deletion I discovered & exploited a few months ago during a real-life exercise. #CVE-2026-7208 https://www.yealink.com/en/trust-center/security-bulletins/race-condition-on-runtime-diagnostic-files-in-yealink-sipt33g https://www.yealink.com/en/trust-center/security-bulletins/yealink-ip-phone-directory-traversal-vulnerability (updated) @VulnCheckAI advisory: https://www.vulncheck.com/advisories/yealink-sip-t33g-race-condition-via-diagnostic-file-deletion
Post summary
The post discloses a race condition and directory traversal vulnerability in Yealink SIP‑T33G phones, noting the author’s discovery and exploitation in a real‑life exercise, and links to vendor advisories and a VulnCheck analysis, but does not provide exploit code or confirm active exploitation.