CVE-2025-52918

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
YealinkRPS< 2025-05-26

References

Timeline

Published
Jun 21, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-529194.3In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalCVE-2025-52926.4The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPCVE-2025-529206.4Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a custoCVE-2025-529219.9In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution oCVE-2025-529227.4Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel coCVE-2025-529234.3Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command.CVE-2025-529244.0In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP rCVE-2025-529255.0In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.CVE-2025-529262.7In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.CVE-2025-529308.8A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressiCVE-2025-529317.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant CVE-2025-529359.4Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with
CVE-2025-52918: Medium severity, CVSS 5.0 | Vulnix