Yealink YMCS RPS API Rate Limiting Vulnerability

A vulnerability exists in the Yealink YMCS RPS API prior to May 26, 2025, due to a lack of rate limiting. This absence of controls could allow for information disclosure by exploiting excessive requests.

Impact

The vulnerability could lead to information disclosure through the exploitation of excessive requests, potentially causing a denial-of-service condition by overwhelming the server with traffic.

Remediation

Yealink has patched this vulnerability by implementing rate limiting controls for sensitive APIs in the YMCS RPS platform. The security update was released on May 26, 2025, and has been automatically deployed to all YMCS cloud service instances.