CVE-2021-27561: Yealink Device Management unauthenticated OS command injection as root

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote root command execution with a CVSS score of 9.8, confirmed exploitation in CISA KEV and a very high EPSS probability.

What it is

Yealink Device Management (DM) 3.6.0.20 exposes the /sm/api/v1/firewall/zone/services URI, which fails to sanitize input and allows OS command injection. Because the injected commands run as root and no authentication is required, an unauthenticated network attacker can fully compromise the management server.

Impact

An attacker gains arbitrary command execution as root on the Yealink DM server, leading to full control of the device, its configuration and any managed endpoints or credentials it holds.

Attack surface

Reachable over the network via the /sm/api/v1/firewall/zone/services endpoint; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is needed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS gives a 30-day exploitation probability of 0.829 (99.7th percentile), indicating active exploitation is likely.

What to do

• Apply the vendor update for Yealink Device Management per vendor instructions (CISA KEV required action).
• If patching is not immediately possible, restrict network access to the DM management interface to trusted administrative networks only.
• Place the DM server behind a firewall or VPN and block direct internet exposure of the /sm/api/v1/ URI paths.
• Monitor and rotate any credentials or certificates stored on or managed by the DM server, since root compromise may expose them.
• Verify the deployed DM version and confirm it is not 3.6.0.20 or another affected release.

Detection

• Inspect web server and application logs for requests to /sm/api/v1/firewall/zone/services, especially with shell metacharacters or unexpected parameters.
• Alert on child processes spawned by the DM web service (e.g., shell, curl, wget, nc) that are unusual for normal operation.
• Monitor for outbound connections from the DM server to unknown hosts, which may indicate post-exploitation activity.
• Review system logs for commands executed as root outside expected administrative windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.