PBXfactory
Start your PBX
All postsYeastar P-Series updates

Yeastar toll fraud advisory: upgrade to V23.3

Published April 23, 20263 min readby The PBXfactory team

On 23 April 2026 Yeastar rated a toll-fraud risk on P-Series PBXs as critical: automated scans find exposed admin portals and attackers place costly calls. The fix is P-Series V23.3 GA (build x.22.0.139), plus locked-down network access, stronger logins and restricted outbound calling. S-Series is not affected.

On 23 April 2026 Yeastar published a security advisory for its P-Series phone systems and rated the risk critical. Attackers use automated tools to scan public IP addresses and ports for PBX systems, get into the PBX management portal and then place unauthorised outbound calls. That is toll fraud: someone else makes expensive calls, and the bill lands with you. Here is what the advisory says, and the wider habits that keep any PBX safe.

What Yeastar's advisory says

According to Yeastar's advisory:

  • Affected: P-Series Cloud Edition, Software Edition and Appliance Edition.
  • Not affected: S-Series VoIP PBXs — no action needed there.
  • The risk: fraudulent outbound calling "with substantial financial loss", and possible service disruption.

Yeastar names three setups as higher risk:

  • Software Edition PBXs on public cloud platforms with a direct public IP address.
  • Deployments on public cloud platforms without strict firewall rules.
  • PBXs where the management portal uses extension numbers as usernames.

The fix: upgrade to Yeastar P-Series V23.3 GA

The advisory's fix is to upgrade to P-Series V23.3 GA, build x.22.0.139. On the Cloud Edition that is firmware 84.22.0.139, released on 21 April 2026 — see Yeastar's release notes. The GA build before it, 84.22.0.138, had already shipped what Yeastar called robust security updates with a strong recommendation to upgrade.

For a single PBX, the upgrade runs under Maintenance › Upgrade in the admin panel. Service providers upgrade Cloud Edition PBXs in batches from Yeastar Central Management.

Beyond the upgrade: what the advisory recommends

Yeastar is clear that firmware alone isn't the whole answer. The advisory recommends:

  • Securing network access — avoid port forwarding and block unauthorised IPs.
  • Hardening authentication — strong credentials and fine-grained access control for extension logins.
  • Restricting outbound calls to prevent fraudulent activity.

It points to Yeastar's VoIP security best practices for more.

VoIP toll fraud prevention: a checklist for any PBX

Toll fraud is old and well understood. These habits help on any phone system, Yeastar or not:

  1. Use strong, unique passwords for every extension, voicemail PIN and admin account. Never leave defaults in place.
  2. Don't use extension numbers as login names for the management portal — Yeastar calls this out as higher risk.
  3. Switch on two-factor authentication for admin logins wherever your PBX offers it.
  4. Limit who can reach the admin portal, by IP address if you can.
  5. Restrict outbound routes. Block international and premium-rate destinations you never call, and allow them only for the extensions that need them.
  6. Ask your SIP trunk provider about limits — a spending cap, international barring or alerts on unusual traffic. If something goes wrong, a limit caps the damage.
  7. Delete unused extensions and remove access when someone leaves.
  8. Watch your call records. Calls at night, to unfamiliar countries or in long bursts are the classic sign.

None of this is exotic, and each step closes a door attackers try first.

What to do if you suspect toll fraud

If your call records show calls nobody in your team made, act quickly — the cost grows by the minute:

  1. Stop outbound calls to the affected destinations. Disable international outbound routes, or the extensions involved, in the PBX admin panel.
  2. Call your SIP trunk provider. Ask them to block international and premium-rate calls on your account for now, and to tell you what traffic they saw.
  3. Change passwords — the admin accounts first, then the extensions that made the calls, then voicemail PINs.
  4. Check who has access. Look for admin users or extensions you don't recognise, and remove them.
  5. Keep the records. Export the call records for the period. Your provider, your insurer or the police may ask for them.

Then work through the checklist above, so the same door can't be used twice.

Who does what on PBXfactory

On a Yeastar P-Series Cloud PBX from PBXfactory, the work is split clearly:

  • We run the PBX on our cloud, apply Yeastar's firmware and security updates — routine ones in announced maintenance windows, urgent security fixes sooner — and monitor that it's running.
  • You decide how the PBX is configured: extension passwords, who may call abroad, outbound routes. That's your PBX, set up in Yeastar's admin panel.
  • Your SIP trunk provider carries the calls. We don't sell trunks or numbers, so spending limits and international barring are agreed with them.

If you'd rather have someone review those settings with you, our support packages include setup help and a managed option. Yeastar's documentation covers each setting in detail.

Questions and answers

Which Yeastar products does the advisory cover?
P-Series Cloud Edition, Software Edition and Appliance Edition. Yeastar says S-Series VoIP PBXs are not affected and need no action.
Which version fixes it?
Yeastar recommends P-Series V23.3 GA, build x.22.0.139 — 84.22.0.139 on the Cloud Edition. See Yeastar's release notes and the advisory.
Is upgrading enough on its own?
No. Yeastar also recommends securing network access, hardening extension logins and restricting outbound calls. Those settings are part of your PBX configuration.
Who updates a PBX from PBXfactory?
We do. We apply Yeastar's firmware and security updates — routine ones in announced maintenance windows, urgent security fixes sooner.