CVE-2025-66738

High · 8.8

CVSS

8.8

EPSS

0.6%

Published

Dec 26, 2025

CISA due date

—

The record

An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.

Affected packages

Ecosystem	Package	Introduced	Fixed