Description

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T14:17:12.120Z",
  "pubdate": "2026-09-14T14:17:12.120Z",
  "executiveSummary": "This vulnerability involves a race condition within the diagnostic subsystems of Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0. The flaw allows an authenticated attacker to manipulate the execution flow of diagnostic processes by exploiting predictable file system interactions. By concurrently triggering a diagnostic utility—such as traceroute or ping—and an administrative file deletion command targeting the utility's output files, an attacker can force an unexpected termination of the process.\nThe primary risk is the destabilization of device management services and potential state inconsistency within the firmware's diagnostic subsystem. Because the vulnerability requires prior authentication, it is classified as a post-authentication issue, typically targeting administrative interfaces. The impact is primarily categorized as a Denial of Service (DoS) regarding diagnostic capabilities, though inconsistent state handling in embedded firmware can sometimes lead to broader instability. Successful exploitation requires precise timing to win the race condition between file creation by the diagnostic process and file deletion by the attacker.",
  "technicalDetails": "The vulnerability resides within the diagnostic module of the Yealink SIP-T33G firmware, which fails to implement atomic operations or file locking mechanisms when handling temporary output generated by network diagnostics. Diagnostic tools such as ping and traceroute write results to predictable paths within the diagnostic directory to facilitate web interface display. The system architecture lacks sufficient synchronization between the write operation performed by the diagnostic utility and the file management operations exposed through the device's web interface or API.\nThe root cause is a Time-of-Check to Time-of-Use (TOCTOU) race condition. When an authenticated user triggers a diagnostic test, the system initializes a process that reserves a predictable filename to store output buffers. Simultaneously, the application exposes an endpoint intended for clearing diagnostic logs or output files. Because these operations are not mutually exclusive and the firmware does not utilize file system locks, an attacker can initiate a diagnostic command and immediately send a concurrent request to delete the target output file while the diagnostic process is attempting to write data.\nThe attack flow follows a specific sequence: First, the attacker authenticates to the device management interface. Second, the attacker initiates a long-running diagnostic utility (e.g., a ping sweep or traceroute) to ensure the target output file is actively being accessed by the diagnostic binary. Third, the attacker rapidly sends deletion requests to the vulnerable file management endpoint. If the deletion command executes while the diagnostic process is attempting to write to the file, the diagnostic process encounters a file handle error or a race-induced resource exception. This forces the premature termination of the process, leaving the system in an inconsistent state where the diagnostic process has crashed or entered a deadlocked state while the file system reference is invalid.\nThis vulnerability is restricted to authenticated users, meaning the impact is tied to the strength of the administrative authentication controls. The exposure exists over the network via the management interface protocols. Successful exploitation results in the disruption of the diagnostic subsystem, rendering monitoring tools temporarily inoperable until the system or affected service recovers."
}