Yealink MeetingBar A30 Command Injection Vulnerability

A command injection vulnerability has been identified in the Yealink MeetingBar A30, specifically in the 133.321.0.3 firmware version. This vulnerability arises from an unknown processing issue within the Diagnostic Handler component, allowing physical access to the device to execute arbitrary commands. The exploitation of this vulnerability does not require authentication, and a proof-of-concept exploit is publicly available.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected device.

Reproduction

To reproduce this vulnerability, physically access the Yealink MeetingBar A30 device. Navigate to 'Device Setting' and then to 'Diagnostic'. Input '127.0.0.1' to execute a command that returns the device's file listing, demonstrating the command injection.