Hackers are using advanced techniques to exploit IP-based security. Upgrade to P-Series V26.1 GA immediately!
Risk Summary
This urgent security alert comes as hackers have advanced their attack methods to get around standard security validation. Using automated tools, attackers scan public IPs and specific ports to find PBX systems, then gain unauthorized login access to the PBX Management Portal. Such exploits enable unauthorized outbound calls, ultimately leading to fraudulent calling that can cause substantial financial loss and disrupt normal communication services.
Risk Level: Critical
Affected Systems
The following deployments and systems are currently under higher risk of attack:
- Affected Products: P-Series Software Edition (PSE); P-Series Appliance Edition (PAE); P-Series Cloud Edition (PCE)
*Note: S-Series VoIP PBXs are not affected by this risk, no additional action is required. - Systems at Higher Risk：
PSE instances installed on public cloud platforms configured with a direct Public IP address.
Deployments on public cloud platforms lacking strict firewall rules.
PBX Systems where the PBX Management Portal utilizes extension numbers as usernames.
Action Requirement: Upgrade to V26.1 GA Urgently
Yeastar urges you to upgrade to the P-Series V26.1 GA (XX.25.0.23 for PAE/PSE & XX.25.0.25 for PCE) as soon as possible. This version includes critical security hardening engineered to defend against these attack vectors.
- Single PBX Upgrade
- Option 1 (Online Upgrade): Login your PBX Management Portal, navigate to Maintenance > Upgrade, select the V26.1 GA version (XX.25.0.23 for PAE/PSE & XX.25.0.25 for PCE), and click Upgrade Now.
- Option 2 (Offline Upgrade): Download the P-Series V26.1 GA firmware directly from here, and go to your pbx for upgrade.
- Batch PBX Upgrade
- For PCE: Use the Task module within Yeastar Central Management (YCM) to schedule and execute automated batch upgrades for your PCE instances.
- For PAE/PSE: Utilize the Yeastar Remote Management Premium (RMP) service linked to your YCM to perform batch upgrades.
*Support Note: If you need RMP service for the batch upgrade but currently do not access to it, please contact us for tailored support.
Security Practice Suggestions
To give your PBX an extra layer of protection against evolving threats, we strongly recommend going beyond firmware updates with robust security practices. This includes securing network access (avoiding port forwarding and blocking unauthorized IPs), hardening authentication (enforcing strong credentials and granular access control for extension logins), and restricting outbound calls to prevent fraudulent activity Please refer to the security practices guide.
Technical Support
If you encounter any issues during the upgrade process or require assistance with security troubleshooting, please feel free to contact the Yeastar Technical Support team.
