Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Scanner template CVE-2021-27561 EUVD-2021-14312GHSA-743m-83p4-9349

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authenticat…

Published Oct 15, 2021 · Updated Oct 21, 2025 · Assigned by mitre

Description

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References