Search
Find a vulnerability
Search criteria
68 vulnerabilities by Yealink
CVE-2026-12223 (GCVE-0-2026-12223)
Vulnerability from nvd – Published: 2026-06-15 05:30 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
Summary
A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. Upgrading to version 108.87.0.23 addresses this issue. Upgrading the affected component is recommended. The vendor explains: "It has been fixed (...) for our technical support branch. However, please note that this specific support branch firmware is not publicly released yet."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370866 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370866/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12223 | third-party-advisory |
| https://vuldb.com/submit/834603 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_webd_TFTPUploa… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12223",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T10:28:55.669324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T10:29:10.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
},
{
"status": "unaffected",
"version": "108.87.0.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChiChen241 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. Upgrading to version 108.87.0.23 addresses this issue. Upgrading the affected component is recommended. The vendor explains: \"It has been fixed (...) for our technical support branch. However, please note that this specific support branch firmware is not publicly released yet.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.2,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:43.675Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370866 | Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370866"
},
{
"name": "VDB-370866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370866/cti"
},
{
"name": "CVE-2026-12223 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12223"
},
{
"name": "Submit #834603 | yealink T46U 108.86.0.118 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834603"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_webd_TFTPUploadIperf_system_exec.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:49:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12223",
"datePublished": "2026-06-15T05:30:11.341Z",
"dateReserved": "2026-06-14T13:54:23.937Z",
"dateUpdated": "2026-06-27T05:45:43.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12222 (GCVE-0-2026-12222)
Vulnerability from nvd – Published: 2026-06-15 05:15 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow
Summary
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370865 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370865/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12222 | third-party-advisory |
| https://vuldb.com/submit/834602 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_webd_BlueTooth… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12222",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T13:11:11.186975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T13:11:18.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChiChen241 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:32.646Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370865 | Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370865"
},
{
"name": "VDB-370865 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370865/cti"
},
{
"name": "CVE-2026-12222 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12222"
},
{
"name": "Submit #834602 | yealink T46U 108.86.0.118 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834602"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_webd_BlueToothTest_off_by_one.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:48:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12222",
"datePublished": "2026-06-15T05:15:09.045Z",
"dateReserved": "2026-06-14T13:54:21.407Z",
"dateUpdated": "2026-06-27T05:45:32.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12221 (GCVE-0-2026-12221)
Vulnerability from nvd – Published: 2026-06-15 05:00 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow
Summary
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370864 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370864/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12221 | third-party-advisory |
| https://vuldb.com/submit/834207 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrad… | broken-linkexploitpatch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T12:50:29.215688Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T12:50:45.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Chunk Upload Handler"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:23.320Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370864 | Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370864"
},
{
"name": "VDB-370864 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370864/cti"
},
{
"name": "CVE-2026-12221 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12221"
},
{
"name": "Submit #834207 | yealink T46U 108.86.0.118 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834207"
},
{
"tags": [
"broken-link",
"exploit",
"patch"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrade_chunk_stack_overflow.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:47:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12221",
"datePublished": "2026-06-15T05:00:10.661Z",
"dateReserved": "2026-06-14T13:54:18.805Z",
"dateUpdated": "2026-06-27T05:45:23.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12220 (GCVE-0-2026-12220)
Vulnerability from nvd – Published: 2026-06-15 04:45 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow
Summary
A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370863 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370863/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12220 | third-party-advisory |
| https://vuldb.com/submit/834205 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_SpareP… | broken-linkexploitpatch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T15:52:49.971836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T19:24:51.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Chunk Upload handler"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:11.834Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370863 | Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370863"
},
{
"name": "VDB-370863 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370863/cti"
},
{
"name": "CVE-2026-12220 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12220"
},
{
"name": "Submit #834205 | yealink T46U 108.86.0.118 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834205"
},
{
"tags": [
"broken-link",
"exploit",
"patch"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_SparePartsUpload_stack_overflow.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:46:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12220",
"datePublished": "2026-06-15T04:45:10.866Z",
"dateReserved": "2026-06-14T13:54:16.276Z",
"dateUpdated": "2026-06-27T05:45:11.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12219 (GCVE-0-2026-12219)
Vulnerability from nvd – Published: 2026-06-15 04:30 – Updated: 2026-06-27 05:44
VLAI
Title
Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection
Summary
A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start of the component Web FastCGI Service. This manipulation of the argument Time causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 108.87.0.23 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370862 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370862/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12219 | third-party-advisory |
| https://vuldb.com/submit/834204 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_diagnose_Comma… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12219",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T21:55:48.720036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T21:55:59.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
},
{
"status": "unaffected",
"version": "108.87.0.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start of the component Web FastCGI Service. This manipulation of the argument Time causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 108.87.0.23 is sufficient to resolve this issue. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:44:59.077Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370862 | Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370862"
},
{
"name": "VDB-370862 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370862/cti"
},
{
"name": "CVE-2026-12219 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12219"
},
{
"name": "Submit #834204 | yealink T46U 108.86.0.118 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834204"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_diagnose_CommandShellByType_iperf_time_cmd_injection.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:46:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12219",
"datePublished": "2026-06-15T04:30:12.020Z",
"dateReserved": "2026-06-14T13:54:13.580Z",
"dateUpdated": "2026-06-27T05:44:59.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12218 (GCVE-0-2026-12218)
Vulnerability from nvd – Published: 2026-06-15 04:15 – Updated: 2026-06-27 05:44
VLAI
Title
Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow
Summary
A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370861 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370861/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12218 | third-party-advisory |
| https://vuldb.com/submit/834193 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_beforewifitest_sta… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12218",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T10:32:54.702711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T10:33:14.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.87.50.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:44:47.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370861 | Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370861"
},
{
"name": "VDB-370861 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370861/cti"
},
{
"name": "CVE-2026-12218 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12218"
},
{
"name": "Submit #834193 | yealink T46U 108.87.50.1 stack",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834193"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_beforewifitest_stack_overflow.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:45:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12218",
"datePublished": "2026-06-15T04:15:10.808Z",
"dateReserved": "2026-06-14T13:54:11.247Z",
"dateUpdated": "2026-06-27T05:44:47.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1735 (GCVE-0-2026-1735)
Vulnerability from nvd – Published: 2026-02-02 00:02 – Updated: 2026-02-23 09:12
VLAI
Title
Yealink MeetingBar A30 Diagnostic command injection
Summary
A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.343634 | vdb-entry |
| https://vuldb.com/?ctiid.343634 | signaturepermissions-required |
| https://vuldb.com/?submit.736622 | third-party-advisory |
| https://drive.google.com/file/d/1Uf46ihr8UmeXsFfk… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yealink | MeetingBar A30 |
Affected:
133.321.0.3
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1735",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-02T17:00:14.639501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T17:03:13.892Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Diagnostic Handler"
],
"product": "MeetingBar A30",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "133.321.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cccll (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T09:12:03.131Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-343634 | Yealink MeetingBar A30 Diagnostic command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.343634"
},
{
"name": "VDB-343634 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.343634"
},
{
"name": "Submit #736622 | Yealink MeetingBar A30 133.321.0.3 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.736622"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Uf46ihr8UmeXsFfkcvAeOtF1TkvGjozy/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-03T11:02:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink MeetingBar A30 Diagnostic command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-1735",
"datePublished": "2026-02-02T00:02:07.695Z",
"dateReserved": "2026-02-01T07:38:04.135Z",
"dateUpdated": "2026-02-23T09:12:03.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68644 (GCVE-0-2025-68644)
Vulnerability from nvd – Published: 2025-12-21 03:01 – Updated: 2025-12-22 20:18 Exclusively Hosted Service
VLAI
Summary
Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-22T20:18:47.264917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T20:18:54.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-06-27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-21T03:53:52.235Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-bulletins/yealink-unauthorized-access-to-rps-vulnerability"
},
{
"url": "https://www.yealink.com/website-service/download/Yealink_RPS_Security_Remediation_Verification_Report.pdf"
}
],
"tags": [
"exclusively-hosted-service"
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-68644",
"datePublished": "2025-12-21T03:01:54.956Z",
"dateReserved": "2025-12-21T03:01:54.706Z",
"dateUpdated": "2025-12-22T20:18:54.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14228 (GCVE-0-2025-14228)
Vulnerability from nvd – Published: 2025-12-08 10:32 – Updated: 2025-12-08 17:16 Unsupported When Assigned
VLAI
Title
Yealink SIP-T21P E2 Local Directory cross site scripting
Summary
A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334670 | vdb-entry |
| https://vuldb.com/?ctiid.334670 | signaturepermissions-required |
| https://vuldb.com/?submit.701949 | third-party-advisory |
| https://drive.google.com/file/d/1vptRtEeoS1AZgnqo… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yealink | SIP-T21P E2 |
Affected:
52.84.0.15
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T17:13:54.771993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T17:16:09.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Local Directory Page"
],
"product": "SIP-T21P E2",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "52.84.0.15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cccll (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T10:32:06.266Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334670 | Yealink SIP-T21P E2 Local Directory cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334670"
},
{
"name": "VDB-334670 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334670"
},
{
"name": "Submit #701949 | Yealink T21P_2E 52.84.0.15 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.701949"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1vptRtEeoS1AZgnqow1yPrsgsBkw4jXc2/view?usp=sharing"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-12-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-07T19:00:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T21P E2 Local Directory cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14228",
"datePublished": "2025-12-08T10:32:06.266Z",
"dateReserved": "2025-12-07T17:55:36.038Z",
"dateUpdated": "2025-12-08T17:16:09.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52919 (GCVE-0-2025-52919)
Vulnerability from nvd – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:16
VLAI
Summary
In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T14:43:45.457965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T14:44:28.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-05-26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:16:08.312Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9"
},
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/ecb16a4993014d22"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52919",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:16:08.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52918 (GCVE-0-2025-52918)
Vulnerability from nvd – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:15
VLAI
Summary
Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52918",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T20:17:17.085484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T20:17:30.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-05-26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:15:33.423Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/1318c5efb82e4526"
},
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=646b44278ef325311f38303f"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52918",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:15:33.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52917 (GCVE-0-2025-52917)
Vulnerability from nvd – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:14
VLAI
Summary
The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T20:19:24.143356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T20:19:49.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-05-26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:14:28.758Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9"
},
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/f8205560a8c7443f"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52917",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:14:28.758Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52916 (GCVE-0-2025-52916)
Vulnerability from nvd – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:13
VLAI
Summary
Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52916",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T20:20:04.987343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T20:20:30.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-06-04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:13:38.211Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/b8dc062eaa8d4f59"
},
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52916",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:13:38.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-12223 (GCVE-0-2026-12223)
Vulnerability from cvelistv5 – Published: 2026-06-15 05:30 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
Summary
A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. Upgrading to version 108.87.0.23 addresses this issue. Upgrading the affected component is recommended. The vendor explains: "It has been fixed (...) for our technical support branch. However, please note that this specific support branch firmware is not publicly released yet."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370866 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370866/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12223 | third-party-advisory |
| https://vuldb.com/submit/834603 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_webd_TFTPUploa… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12223",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T10:28:55.669324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T10:29:10.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
},
{
"status": "unaffected",
"version": "108.87.0.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChiChen241 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. Upgrading to version 108.87.0.23 addresses this issue. Upgrading the affected component is recommended. The vendor explains: \"It has been fixed (...) for our technical support branch. However, please note that this specific support branch firmware is not publicly released yet.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.2,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:43.675Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370866 | Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370866"
},
{
"name": "VDB-370866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370866/cti"
},
{
"name": "CVE-2026-12223 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12223"
},
{
"name": "Submit #834603 | yealink T46U 108.86.0.118 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834603"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_webd_TFTPUploadIperf_system_exec.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:49:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12223",
"datePublished": "2026-06-15T05:30:11.341Z",
"dateReserved": "2026-06-14T13:54:23.937Z",
"dateUpdated": "2026-06-27T05:45:43.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12222 (GCVE-0-2026-12222)
Vulnerability from cvelistv5 – Published: 2026-06-15 05:15 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow
Summary
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370865 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370865/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12222 | third-party-advisory |
| https://vuldb.com/submit/834602 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_webd_BlueTooth… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12222",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T13:11:11.186975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T13:11:18.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChiChen241 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:32.646Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370865 | Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370865"
},
{
"name": "VDB-370865 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370865/cti"
},
{
"name": "CVE-2026-12222 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12222"
},
{
"name": "Submit #834602 | yealink T46U 108.86.0.118 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834602"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_webd_BlueToothTest_off_by_one.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:48:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12222",
"datePublished": "2026-06-15T05:15:09.045Z",
"dateReserved": "2026-06-14T13:54:21.407Z",
"dateUpdated": "2026-06-27T05:45:32.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12221 (GCVE-0-2026-12221)
Vulnerability from cvelistv5 – Published: 2026-06-15 05:00 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow
Summary
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370864 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370864/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12221 | third-party-advisory |
| https://vuldb.com/submit/834207 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrad… | broken-linkexploitpatch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T12:50:29.215688Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T12:50:45.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Chunk Upload Handler"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:23.320Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370864 | Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370864"
},
{
"name": "VDB-370864 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370864/cti"
},
{
"name": "CVE-2026-12221 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12221"
},
{
"name": "Submit #834207 | yealink T46U 108.86.0.118 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834207"
},
{
"tags": [
"broken-link",
"exploit",
"patch"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrade_chunk_stack_overflow.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:47:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12221",
"datePublished": "2026-06-15T05:00:10.661Z",
"dateReserved": "2026-06-14T13:54:18.805Z",
"dateUpdated": "2026-06-27T05:45:23.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12220 (GCVE-0-2026-12220)
Vulnerability from cvelistv5 – Published: 2026-06-15 04:45 – Updated: 2026-06-27 05:45
VLAI
Title
Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow
Summary
A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370863 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370863/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12220 | third-party-advisory |
| https://vuldb.com/submit/834205 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_SpareP… | broken-linkexploitpatch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T15:52:49.971836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T19:24:51.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Chunk Upload handler"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:45:11.834Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370863 | Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370863"
},
{
"name": "VDB-370863 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370863/cti"
},
{
"name": "CVE-2026-12220 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12220"
},
{
"name": "Submit #834205 | yealink T46U 108.86.0.118 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834205"
},
{
"tags": [
"broken-link",
"exploit",
"patch"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_SparePartsUpload_stack_overflow.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:46:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12220",
"datePublished": "2026-06-15T04:45:10.866Z",
"dateReserved": "2026-06-14T13:54:16.276Z",
"dateUpdated": "2026-06-27T05:45:11.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12219 (GCVE-0-2026-12219)
Vulnerability from cvelistv5 – Published: 2026-06-15 04:30 – Updated: 2026-06-27 05:44
VLAI
Title
Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection
Summary
A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start of the component Web FastCGI Service. This manipulation of the argument Time causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 108.87.0.23 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370862 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370862/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12219 | third-party-advisory |
| https://vuldb.com/submit/834204 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_mod_diagnose_Comma… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12219",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T21:55:48.720036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T21:55:59.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.86.0.118"
},
{
"status": "unaffected",
"version": "108.87.0.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start of the component Web FastCGI Service. This manipulation of the argument Time causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 108.87.0.23 is sufficient to resolve this issue. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:44:59.077Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370862 | Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370862"
},
{
"name": "VDB-370862 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370862/cti"
},
{
"name": "CVE-2026-12219 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12219"
},
{
"name": "Submit #834204 | yealink T46U 108.86.0.118 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834204"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_mod_diagnose_CommandShellByType_iperf_time_cmd_injection.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:46:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12219",
"datePublished": "2026-06-15T04:30:12.020Z",
"dateReserved": "2026-06-14T13:54:13.580Z",
"dateUpdated": "2026-06-27T05:44:59.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12218 (GCVE-0-2026-12218)
Vulnerability from cvelistv5 – Published: 2026-06-15 04:15 – Updated: 2026-06-27 05:44
VLAI
Title
Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow
Summary
A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/370861 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/370861/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-12218 | third-party-advisory |
| https://vuldb.com/submit/834193 | third-party-advisory |
| http://cdn2.v50to.cc/T46U/T46U_beforewifitest_sta… | broken-linkexploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12218",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T10:32:54.702711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T10:33:14.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*"
],
"modules": [
"Web FastCGI Service"
],
"product": "SIP-T46U",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "108.87.50.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.7,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T05:44:47.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-370861 | Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/370861"
},
{
"name": "VDB-370861 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/370861/cti"
},
{
"name": "CVE-2026-12218 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-12218"
},
{
"name": "Submit #834193 | yealink T46U 108.87.50.1 stack",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834193"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "http://cdn2.v50to.cc/T46U/T46U_beforewifitest_stack_overflow.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T07:45:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-12218",
"datePublished": "2026-06-15T04:15:10.808Z",
"dateReserved": "2026-06-14T13:54:11.247Z",
"dateUpdated": "2026-06-27T05:44:47.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1735 (GCVE-0-2026-1735)
Vulnerability from cvelistv5 – Published: 2026-02-02 00:02 – Updated: 2026-02-23 09:12
VLAI
Title
Yealink MeetingBar A30 Diagnostic command injection
Summary
A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.343634 | vdb-entry |
| https://vuldb.com/?ctiid.343634 | signaturepermissions-required |
| https://vuldb.com/?submit.736622 | third-party-advisory |
| https://drive.google.com/file/d/1Uf46ihr8UmeXsFfk… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yealink | MeetingBar A30 |
Affected:
133.321.0.3
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1735",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-02T17:00:14.639501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T17:03:13.892Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Diagnostic Handler"
],
"product": "MeetingBar A30",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "133.321.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cccll (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T09:12:03.131Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-343634 | Yealink MeetingBar A30 Diagnostic command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.343634"
},
{
"name": "VDB-343634 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.343634"
},
{
"name": "Submit #736622 | Yealink MeetingBar A30 133.321.0.3 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.736622"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Uf46ihr8UmeXsFfkcvAeOtF1TkvGjozy/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-03T11:02:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink MeetingBar A30 Diagnostic command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-1735",
"datePublished": "2026-02-02T00:02:07.695Z",
"dateReserved": "2026-02-01T07:38:04.135Z",
"dateUpdated": "2026-02-23T09:12:03.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68644 (GCVE-0-2025-68644)
Vulnerability from cvelistv5 – Published: 2025-12-21 03:01 – Updated: 2025-12-22 20:18 Exclusively Hosted Service
VLAI
Summary
Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-22T20:18:47.264917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T20:18:54.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-06-27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-21T03:53:52.235Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-bulletins/yealink-unauthorized-access-to-rps-vulnerability"
},
{
"url": "https://www.yealink.com/website-service/download/Yealink_RPS_Security_Remediation_Verification_Report.pdf"
}
],
"tags": [
"exclusively-hosted-service"
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-68644",
"datePublished": "2025-12-21T03:01:54.956Z",
"dateReserved": "2025-12-21T03:01:54.706Z",
"dateUpdated": "2025-12-22T20:18:54.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14228 (GCVE-0-2025-14228)
Vulnerability from cvelistv5 – Published: 2025-12-08 10:32 – Updated: 2025-12-08 17:16 Unsupported When Assigned
VLAI
Title
Yealink SIP-T21P E2 Local Directory cross site scripting
Summary
A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334670 | vdb-entry |
| https://vuldb.com/?ctiid.334670 | signaturepermissions-required |
| https://vuldb.com/?submit.701949 | third-party-advisory |
| https://drive.google.com/file/d/1vptRtEeoS1AZgnqo… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yealink | SIP-T21P E2 |
Affected:
52.84.0.15
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T17:13:54.771993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T17:16:09.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Local Directory Page"
],
"product": "SIP-T21P E2",
"vendor": "Yealink",
"versions": [
{
"status": "affected",
"version": "52.84.0.15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cccll (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T10:32:06.266Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334670 | Yealink SIP-T21P E2 Local Directory cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334670"
},
{
"name": "VDB-334670 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334670"
},
{
"name": "Submit #701949 | Yealink T21P_2E 52.84.0.15 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.701949"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1vptRtEeoS1AZgnqow1yPrsgsBkw4jXc2/view?usp=sharing"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-12-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-07T19:00:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yealink SIP-T21P E2 Local Directory cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14228",
"datePublished": "2025-12-08T10:32:06.266Z",
"dateReserved": "2025-12-07T17:55:36.038Z",
"dateUpdated": "2025-12-08T17:16:09.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52918 (GCVE-0-2025-52918)
Vulnerability from cvelistv5 – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:15
VLAI
Summary
Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52918",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T20:17:17.085484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T20:17:30.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-05-26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:15:33.423Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/1318c5efb82e4526"
},
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=646b44278ef325311f38303f"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52918",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:15:33.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52916 (GCVE-0-2025-52916)
Vulnerability from cvelistv5 – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:13
VLAI
Summary
Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52916",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T20:20:04.987343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T20:20:30.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-06-04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:13:38.211Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/b8dc062eaa8d4f59"
},
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52916",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:13:38.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52919 (GCVE-0-2025-52919)
Vulnerability from cvelistv5 – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:16
VLAI
Summary
In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T14:43:45.457965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T14:44:28.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-05-26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:16:08.312Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9"
},
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/ecb16a4993014d22"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52919",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:16:08.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52917 (GCVE-0-2025-52917)
Vulnerability from cvelistv5 – Published: 2025-06-21 00:00 – Updated: 2025-07-28 13:14
VLAI
Summary
The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T20:19:24.143356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T20:19:49.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RPS",
"vendor": "Yealink",
"versions": [
{
"lessThan": "2025-05-26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T13:14:28.758Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9"
},
{
"url": "https://www.yealink.com/en/trust-center/security-advisories/f8205560a8c7443f"
},
{
"url": "https://seclists.org/fulldisclosure/2025/Jun/20"
},
{
"url": "https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52917",
"datePublished": "2025-06-21T00:00:00.000Z",
"dateReserved": "2025-06-21T00:00:00.000Z",
"dateUpdated": "2025-07-28T13:14:28.758Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-201408-0026
Vulnerability from variot - Updated: 2025-04-13 23:14cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files. Yealink VoIP Phone SIP-T38G is an enterprise HD IP phone. The remote attacker is allowed to exploit the vulnerability to submit a special request and execute arbitrary commands with WEB privileges because the user-submitted input is not properly filtered. An attacker may leverage this issue to execute arbitrary commands in the context of the affected application
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201408-0026",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sip-t38g",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "sip-t38g",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "voip phone sip-t38g",
"scope": null,
"trust": 0.6,
"vendor": "yealink",
"version": null
},
{
"model": "sip-t38g",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"db": "BID",
"id": "68052"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:yealink:sip-t38g",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mr.Un1k0d3r \u0026 Doreth.Z10 From RingZer0 Team",
"sources": [
{
"db": "BID",
"id": "68052"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
}
],
"trust": 0.9
},
"cve": "CVE-2013-5758",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2013-5758",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-03773",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-5758",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-5758",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-03773",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201406-644",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files. Yealink VoIP Phone SIP-T38G is an enterprise HD IP phone. The remote attacker is allowed to exploit the vulnerability to submit a special request and execute arbitrary commands with WEB privileges because the user-submitted input is not properly filtered. \nAn attacker may leverage this issue to execute arbitrary commands in the context of the affected application",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-5758"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"db": "BID",
"id": "68052"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-5758",
"trust": 3.3
},
{
"db": "OSVDB",
"id": "108080",
"trust": 2.4
},
{
"db": "EXPLOIT-DB",
"id": "33741",
"trust": 2.2
},
{
"db": "PACKETSTORM",
"id": "127093",
"trust": 1.6
},
{
"db": "PACKETSTORM",
"id": "127096",
"trust": 1.6
},
{
"db": "EXPLOIT-DB",
"id": "33742",
"trust": 1.6
},
{
"db": "BID",
"id": "68052",
"trust": 1.5
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625",
"trust": 0.8
},
{
"db": "EXPLOITDB",
"id": "33741",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2014-03773",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"db": "BID",
"id": "68052"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"id": "VAR-201408-0026",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
}
]
},
"last_update_date": "2025-04-13T23:14:45.559000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Gigabit Color IP Phone SIP-T38G",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=182"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://www.osvdb.org/108080"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/33741"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.com/files/127093/yealink-voip-phone-sip-t38g-privilege-escalation.html"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/33742"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.com/files/127096/yealink-voip-phone-sip-t38g-remote-command-execution.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5758"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-5758"
},
{
"trust": 0.6,
"url": "http://www.exploit-db.com/exploits/33741/"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/68052"
},
{
"trust": 0.3,
"url": "www.yealink.com"
},
{
"trust": 0.3,
"url": "http://www.yealink.com/product_info.aspx?productscateid=182"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"db": "BID",
"id": "68052"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"db": "BID",
"id": "68052"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"date": "2014-06-13T00:00:00",
"db": "BID",
"id": "68052"
},
{
"date": "2014-08-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"date": "2014-06-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"date": "2014-08-03T18:55:04.943000",
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03773"
},
{
"date": "2014-06-13T00:00:00",
"db": "BID",
"id": "68052"
},
{
"date": "2014-08-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-006625"
},
{
"date": "2014-08-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-644"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2013-5758"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yealink VoIP Phone SIP-T38G of cgi-bin/cgiServer.exx Vulnerable to arbitrary command execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006625"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-644"
}
],
"trust": 0.6
}
}
VAR-201409-0044
Vulnerability from variot - Updated: 2025-04-13 23:10Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com. Yealink VOIP Phone is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.
For more information: SA48299
Please see the vendor's advisory for a list of affected products. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: IBM Maximo Asset Management Products Weakness and Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA48299
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48299/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48299
RELEASE DATE: 2012-03-07
DISCUSS ADVISORY: http://secunia.com/advisories/48299/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/48299/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48299
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A weakness and multiple vulnerabilities have been reported in IBM Maximo Asset Management and IBM Maximo Asset Management Essentials, which can be exploited by malicious users to disclose sensitive information and conduct SQL injection attacks and by malicious people to conduct spoofing attacks, cross-site scripting attacks, cross-site request forgery attacks, and cause a DoS (Denial of Service).
1) The weakness is caused due to the about option in the help menu displaying an otherwise restricted username.
2) Input passed via the "uisessionid" parameter to an unspecified script is not properly verified before being used to redirect users. This can be exploited to redirect users to arbitrary web sites.
3) Input passed via the "controlid" parameter to imicon.jsp and the "reportType" parameter to an unspecified script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
4) Input passed via the "uisesionid" parameter to ui/ and maximo.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
5) Certain input in Start Center Layout and Configuration is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
6) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. conduct web cache poisoning and cross-site scripting attacks by tricking a logged in user into visiting a malicious web site.
7) An error when handling multiple UI sessions in an HTTP session can be exploited to consume large amounts of memory and render the server unusable.
8) Certain input passed to the KPI component is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerabilities are reported in versions 6.2, 7.1, and 7.5.
SOLUTION: Apply APAR or interim fix (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: IBM (IV09157, IV09189, IV09190, IV09193, IV09194, IV09197, IV09200, IV09202, IV09198): http://www.ibm.com/support/docview.wss?uid=swg21584666 http://xforce.iss.net/xforce/xfdb/72004 http://xforce.iss.net/xforce/xfdb/72006 http://xforce.iss.net/xforce/xfdb/71996 http://xforce.iss.net/xforce/xfdb/71999 http://xforce.iss.net/xforce/xfdb/72008 http://xforce.iss.net/xforce/xfdb/72612 http://xforce.iss.net/xforce/xfdb/72000 http://xforce.iss.net/xforce/xfdb/71985 http://xforce.iss.net/xforce/xfdb/72001
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
SOLUTION: Filter malicious characters and character sequences using a proxy
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0044",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ip phone sip-t20p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "w52p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ip video phone vp530",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ip phone sip-t22p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ip phone sip-t26p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ip phone sip-t28p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ip phone sip-t19p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "gigabit color ip phone sip-t38g",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ip phone sip-t21p",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "gigabit color ip phone sip-t32g",
"scope": "eq",
"trust": 1.6,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant ip phone sip-t42g",
"scope": "eq",
"trust": 1.0,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant ip phone sip-t46g",
"scope": "eq",
"trust": 1.0,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant ip phone sip-t48g",
"scope": "eq",
"trust": 1.0,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant ip phone sip-t41p",
"scope": "eq",
"trust": 1.0,
"vendor": "yealink",
"version": null
},
{
"model": "business hd ip dect phone w52p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "enterprise hd ip phone sip-t20p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "enterprise hd ip phone sip-t22p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "enterprise hd ip phone sip-t26p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "enterprise hd ip phone sip-t28p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "entry-level ip phone sip-t19p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "entry-level ip phone sip-t21p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "gigabit color ip phone sip-t32g",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "gigabit color ip phone sip-t38g",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "ip video phone vp530",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant gigabit ip phone sip-t42g",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant gigabit ip phone sip-t46g",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant gigabit ip phone sip-t48g",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "ultra-elegant ip phone sip-t41p",
"scope": null,
"trust": 0.8,
"vendor": "yealink",
"version": null
},
{
"model": "network technology yealink voip phone",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "52209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:yealink:w52p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_phone_sip-t20p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_phone_sip-t22p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_phone_sip-t26p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_phone_sip-t28p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_phone_sip-t19p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_phone_sip-t21p",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:gigabit_color_ip_phone_sip-t32g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:gigabit_color_ip_phone_sip-t38g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ip_video_phone_vp530",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ultra-elegant_ip_phone_sip-t42g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ultra-elegant_ip_phone_sip-t46g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ultra-elegant_ip_phone_sip-t48g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:yealink:ultra-elegant_ip_phone_sip-t41p",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Narendra Shinde",
"sources": [
{
"db": "BID",
"id": "52209"
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
}
],
"trust": 0.9
},
"cve": "CVE-2012-1417",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CVE-2012-1417",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1417",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2012-1417",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-201202-515",
"trust": 0.6,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com. Yealink VOIP Phone is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. \nAttacker-supplied HTML or JavaScript code could run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible. \n\nFor more information:\nSA48299\n\nPlease see the vendor\u0027s advisory for a list of affected products. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nIBM Maximo Asset Management Products Weakness and Multiple\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA48299\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/48299/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48299\n\nRELEASE DATE:\n2012-03-07\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/48299/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/48299/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48299\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA weakness and multiple vulnerabilities have been reported in IBM\nMaximo Asset Management and IBM Maximo Asset Management Essentials,\nwhich can be exploited by malicious users to disclose sensitive\ninformation and conduct SQL injection attacks and by malicious people\nto conduct spoofing attacks, cross-site scripting attacks, cross-site\nrequest forgery attacks, and cause a DoS (Denial of Service). \n\n1) The weakness is caused due to the about option in the help menu\ndisplaying an otherwise restricted username. \n\n2) Input passed via the \"uisessionid\" parameter to an unspecified\nscript is not properly verified before being used to redirect users. \nThis can be exploited to redirect users to arbitrary web sites. \n\n3) Input passed via the \"controlid\" parameter to imicon.jsp and the\n\"reportType\" parameter to an unspecified script is not properly\nsanitised before being returned to the user. This can be exploited to\nexecute arbitrary HTML and script code in a user\u0027s browser session in\ncontext of an affected site. \n\n4) Input passed via the \"uisesionid\" parameter to ui/ and maximo.jsp\nis not properly sanitised before being returned to the user. This can\nbe exploited to execute arbitrary HTML and script code in a user\u0027s\nbrowser session in context of an affected site. \n\n5) Certain input in Start Center Layout and Configuration is not\nproperly sanitised before being returned to the user. This can be\nexploited to execute arbitrary HTML and script code in a user\u0027s\nbrowser session in context of an affected site. \n\n6) The application allows users to perform certain actions via HTTP\nrequests without performing any validity checks to verify the\nrequests. This can be exploited to e.g. conduct web cache poisoning\nand cross-site scripting attacks by tricking a logged in user into\nvisiting a malicious web site. \n\n7) An error when handling multiple UI sessions in an HTTP session can\nbe exploited to consume large amounts of memory and render the server\nunusable. \n\n8) Certain input passed to the KPI component is not properly\nsanitised before being used in SQL queries. This can be exploited to\nmanipulate SQL queries by injecting arbitrary SQL code. \n\nThe vulnerabilities are reported in versions 6.2, 7.1, and 7.5. \n\nSOLUTION:\nApply APAR or interim fix (please see the vendor\u0027s advisory for\ndetails). \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nIBM (IV09157, IV09189, IV09190, IV09193, IV09194, IV09197, IV09200,\nIV09202, IV09198):\nhttp://www.ibm.com/support/docview.wss?uid=swg21584666\nhttp://xforce.iss.net/xforce/xfdb/72004\nhttp://xforce.iss.net/xforce/xfdb/72006\nhttp://xforce.iss.net/xforce/xfdb/71996\nhttp://xforce.iss.net/xforce/xfdb/71999\nhttp://xforce.iss.net/xforce/xfdb/72008\nhttp://xforce.iss.net/xforce/xfdb/72612\nhttp://xforce.iss.net/xforce/xfdb/72000\nhttp://xforce.iss.net/xforce/xfdb/71985\nhttp://xforce.iss.net/xforce/xfdb/72001\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nSOLUTION:\nFilter malicious characters and character sequences using a proxy",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1417"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "BID",
"id": "52209"
},
{
"db": "PACKETSTORM",
"id": "110526"
},
{
"db": "PACKETSTORM",
"id": "110571"
},
{
"db": "PACKETSTORM",
"id": "110655"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1417",
"trust": 2.7
},
{
"db": "PACKETSTORM",
"id": "110320",
"trust": 2.4
},
{
"db": "BID",
"id": "52209",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "48194",
"trust": 1.8
},
{
"db": "EXPLOIT-DB",
"id": "18540",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "79675",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2012-006271",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "48299",
"trust": 0.8
},
{
"db": "XF",
"id": "73573",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515",
"trust": 0.6
},
{
"db": "XF",
"id": "72612",
"trust": 0.2
},
{
"db": "XF",
"id": "72000",
"trust": 0.2
},
{
"db": "XF",
"id": "72004",
"trust": 0.2
},
{
"db": "XF",
"id": "71985",
"trust": 0.2
},
{
"db": "XF",
"id": "72001",
"trust": 0.2
},
{
"db": "SECUNIA",
"id": "48305",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "110526",
"trust": 0.1
},
{
"db": "XF",
"id": "72006",
"trust": 0.1
},
{
"db": "XF",
"id": "71999",
"trust": 0.1
},
{
"db": "XF",
"id": "71996",
"trust": 0.1
},
{
"db": "XF",
"id": "72008",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "110571",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "110655",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "52209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "PACKETSTORM",
"id": "110526"
},
{
"db": "PACKETSTORM",
"id": "110571"
},
{
"db": "PACKETSTORM",
"id": "110655"
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"id": "VAR-201409-0044",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2025-04-13T23:10:27.352000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Entry-level IP Phone SIP-T19P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=334\u0026CateId=147\u0026BaseInfoCateId=334\u0026Cate_Id=334\u0026parentcateid=147"
},
{
"title": "Ultra-elegant Gigabit IP Phone SIP-T42G",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=312\u0026CateId=147\u0026BaseInfoCateId=312\u0026Cate_Id=312\u0026parentcateid=147"
},
{
"title": "Enterprise HD IP Phone SIP-T20P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=187\u0026CateId=147\u0026BaseInfoCateId=187\u0026Cate_Id=187\u0026parentcateid=147"
},
{
"title": "Ultra-elegant Gigabit IP Phone SIP-T46G",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=310\u0026CateId=147\u0026BaseInfoCateId=310\u0026Cate_Id=310\u0026parentcateid=147"
},
{
"title": "Entry-level IP Phone SIP-T21P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=333\u0026CateId=147\u0026BaseInfoCateId=333\u0026Cate_Id=333\u0026parentcateid=147"
},
{
"title": "Ultra-elegant Gigabit IP Phone SIP-T48G",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=1206\u0026CateId=147\u0026BaseInfoCateId=1206\u0026Cate_Id=1206\u0026parentcateid=147"
},
{
"title": "Enterprise HD IP Phone SIP-T22P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=186\u0026CateId=147\u0026BaseInfoCateId=186\u0026Cate_Id=186\u0026parentcateid=147"
},
{
"title": "Business HD IP DECT Phone W52P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=308"
},
{
"title": "Enterprise HD IP Phone SIP-T26P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=185\u0026CateId=147\u0026BaseInfoCateId=185\u0026Cate_Id=185\u0026parentcateid=147"
},
{
"title": "Gigabit Color IP Phone SIP-T38G",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=182\u0026CateId=147\u0026BaseInfoCateId=182\u0026Cate_Id=182\u0026parentcateid=147"
},
{
"title": "Enterprise HD IP Phone SIP-T28P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=184\u0026CateId=147\u0026BaseInfoCateId=184\u0026Cate_Id=184\u0026parentcateid=147"
},
{
"title": "IP Video Phone VP530",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?parentcateid=146\u0026ProductsCateID=180\u0026cateid=180\u0026ProductsID=27"
},
{
"title": "Gigabit Color IP Phone SIP-T32G",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=183\u0026CateId=147\u0026BaseInfoCateId=183\u0026Cate_Id=183\u0026parentcateid=147"
},
{
"title": "Ultra-elegant IP Phone SIP-T41P",
"trust": 0.8,
"url": "http://www.yealink.com/product_info.aspx?ProductsCateID=313\u0026CateId=147\u0026BaseInfoCateId=313\u0026Cate_Id=313\u0026parentcateid=147"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.org/files/110320/yealink-xss.txt"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/18540"
},
{
"trust": 1.6,
"url": "http://www.osvdb.org/79675"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/52209"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/48194"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73573"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1417"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1417"
},
{
"trust": 0.8,
"url": "http://packetstormsecurity.com/files/110320/yealink-xss.txt"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/73573"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/48299"
},
{
"trust": 0.3,
"url": "http://www.vulnerability-lab.com/get_content.php?id=461"
},
{
"trust": 0.3,
"url": "http://www.osqa.net/learn-more/"
},
{
"trust": 0.3,
"url": "/archive/1/521798"
},
{
"trust": 0.3,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://xforce.iss.net/xforce/xfdb/72000"
},
{
"trust": 0.2,
"url": "http://www.ibm.com/support/docview.wss?uid=swg21584666"
},
{
"trust": 0.2,
"url": "http://xforce.iss.net/xforce/xfdb/72001"
},
{
"trust": 0.2,
"url": "http://xforce.iss.net/xforce/xfdb/71985"
},
{
"trust": 0.2,
"url": "http://xforce.iss.net/xforce/xfdb/72612"
},
{
"trust": 0.2,
"url": "http://xforce.iss.net/xforce/xfdb/72004"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48305/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48305/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48305"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48299"
},
{
"trust": 0.1,
"url": "http://xforce.iss.net/xforce/xfdb/72006"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48299/"
},
{
"trust": 0.1,
"url": "http://xforce.iss.net/xforce/xfdb/71996"
},
{
"trust": 0.1,
"url": "http://xforce.iss.net/xforce/xfdb/71999"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48299/#comments"
},
{
"trust": 0.1,
"url": "http://xforce.iss.net/xforce/xfdb/72008"
},
{
"trust": 0.1,
"url": "http://www.exploit-db.com/exploits/18540/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48194/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48194"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48194/#comments"
}
],
"sources": [
{
"db": "BID",
"id": "52209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "PACKETSTORM",
"id": "110526"
},
{
"db": "PACKETSTORM",
"id": "110571"
},
{
"db": "PACKETSTORM",
"id": "110655"
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "52209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"db": "PACKETSTORM",
"id": "110526"
},
{
"db": "PACKETSTORM",
"id": "110571"
},
{
"db": "PACKETSTORM",
"id": "110655"
},
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-02-29T00:00:00",
"db": "BID",
"id": "52209"
},
{
"date": "2014-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"date": "2012-03-07T03:04:05",
"db": "PACKETSTORM",
"id": "110526"
},
{
"date": "2012-03-08T07:44:51",
"db": "PACKETSTORM",
"id": "110571"
},
{
"date": "2012-03-11T05:32:29",
"db": "PACKETSTORM",
"id": "110655"
},
{
"date": "2012-02-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"date": "2014-09-17T14:55:02.963000",
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-02-29T00:00:00",
"db": "BID",
"id": "52209"
},
{
"date": "2014-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-006271"
},
{
"date": "2014-09-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201202-515"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2012-1417"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yealink VOIP Phone of Local Phone Cross-site scripting vulnerability in books and blacklists",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-006271"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201202-515"
}
],
"trust": 0.6
}
}
VAR-201407-0034
Vulnerability from variot - Updated: 2025-04-12 23:28CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet. Yealink VoIP Phone The firmware of CRLF An injection vulnerability exists. Supplementary information : CWE Vulnerability type by CWE-93: Improper Neutralization of CRLF Sequences (CRLF injection ) Has been identified. Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Yealink VoIP Phones are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. I. BACKGROUND
Yealink is a manufacturer of VoIP and Video products. To minimize noise read more at:
http://www.yealink.com/Companyprofile.aspx
III. Validated on
Firmware Version 28.72.0.2 Hardware Version 28.2.0.128.0.0.0
CRLF Injection (Header Splitting) proof of concept:
Request GET /servlet?linepage=1&model=%0d%0a%20 ANYTHING I WANT GOES HERE &p=dsskey&q=load HTTP/1.1
In the above request, attackers can shove in code, webpages, etc. In my tests, I have used javascript, redirects, and even an entire web page shoved into the CRLF vulnerable inputs.
The XSS vulnerability
GET /servlet?jumpto=dsskey&model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22&p=login&q=loginForm HTTP/1.1
Typical Cross Site Scripting.
IV. SOLUTION
Minimize accessibility to the phone's interface.
V. VENDOR CONTACT AND RESPONSE
05/08/2014 E-mailed security@yealink.com (bounced) 05/08/2014 Created an account on Yealink's forum and sent message (no response for weeks) 05/26/2014 Response via e-mail from Yealink 05/26/2014 Replied to vendor I would disclose in June 06/01/2014 Reached back out to vendor for update 06/08/2014 Reached back out to vendor for update 06/11/2014 Rouched out one last time... Crickets 06/12/2014 Advisory
VI. TOOLS USED
Burpsuite, WVS, Firefox
-- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
"Where ignorance is our master, there is no possibility of real peace" - Dalai Lama
42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0034",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "voip phone",
"scope": "eq",
"trust": 2.4,
"vendor": "yealink",
"version": "28.72.0.2"
},
{
"model": "voip phone",
"scope": "eq",
"trust": 0.8,
"vendor": "yealink",
"version": "28.2.0.128.0.0.0"
},
{
"model": "hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "28.2.0.128.0.0.0"
},
{
"model": "yealink",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "28.72.0.2"
}
],
"sources": [
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:yealink:voip_phone",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:yealink:voip_phone_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jesus Oquendo",
"sources": [
{
"db": "BID",
"id": "68022"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
}
],
"trust": 1.0
},
"cve": "CVE-2014-3427",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2014-3427",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-71367",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-3427",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-3427",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201406-642",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-71367",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet. Yealink VoIP Phone The firmware of CRLF An injection vulnerability exists. Supplementary information : CWE Vulnerability type by CWE-93: Improper Neutralization of CRLF Sequences (CRLF injection ) Has been identified. Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. \nAn attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Yealink VoIP Phones are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. \nI. \tBACKGROUND\n\nYealink is a manufacturer of VoIP and Video products. To\nminimize noise read more at:\n\nhttp://www.yealink.com/Companyprofile.aspx\n\n\nIII. Validated on \n\nFirmware Version 28.72.0.2\nHardware Version 28.2.0.128.0.0.0\n\nCRLF Injection (Header Splitting) proof of concept:\n\nRequest\nGET /servlet?linepage=1\u0026model=%0d%0a%20 ANYTHING I WANT GOES HERE \u0026p=dsskey\u0026q=load HTTP/1.1\n\nIn the above request, attackers can shove in code, webpages,\netc. In my tests, I have used javascript, redirects, and even\nan entire web page shoved into the CRLF vulnerable inputs. \n\n\n-----\n\n\nThe XSS vulnerability\n\nGET /servlet?jumpto=dsskey\u0026model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22\u0026p=login\u0026q=loginForm HTTP/1.1\n\nTypical Cross Site Scripting. \n\n\nIV. \tSOLUTION\n\nMinimize accessibility to the phone\u0027s interface. \n\n\nV. \tVENDOR CONTACT AND RESPONSE\n\n05/08/2014\tE-mailed security@yealink.com (bounced)\n05/08/2014\tCreated an account on Yealink\u0027s forum and\n\t\tsent message (no response for weeks)\n05/26/2014\tResponse via e-mail from Yealink\n05/26/2014\tReplied to vendor I would disclose in June\n06/01/2014\tReached back out to vendor for update\n06/08/2014\tReached back out to vendor for update\n06/11/2014\tRouched out one last time... Crickets\n06/12/2014\tAdvisory\n\n\nVI. \tTOOLS USED\n\nBurpsuite, WVS, Firefox\n\n\n\n-- \n=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\nJ. Oquendo\nSGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM\n\n\"Where ignorance is our master, there is no possibility of\nreal peace\" - Dalai Lama\n\n42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF\nhttp://pgp.mit.edu:11371/pks/lookup?op=get\u0026search=0x2BF7D83F210A95AF\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3427"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "PACKETSTORM",
"id": "127081"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-71367",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-3427",
"trust": 2.9
},
{
"db": "PACKETSTORM",
"id": "127081",
"trust": 1.2
},
{
"db": "BID",
"id": "68022",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642",
"trust": 0.7
},
{
"db": "EXPLOIT-DB",
"id": "39334",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-71367",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"id": "VAR-201407-0034",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-12T23:28:55.466000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.yealink.com/index.aspx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/jun/74"
},
{
"trust": 1.4,
"url": "http://www.securityfocus.com/archive/1/archive/1/532410/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/532410/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://packetstormsecurity.com/files/127081/yealink-voip-phones-xss-crlf-injection.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3427"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3427"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/68022"
},
{
"trust": 0.3,
"url": "www.yealink.com"
},
{
"trust": 0.1,
"url": "http://www.yealink.com/companyprofile.aspx"
},
{
"trust": 0.1,
"url": "http://pgp.mit.edu:11371/pks/lookup?op=get\u0026search=0x2bf7d83f210a95af"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3428"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3427"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-16T00:00:00",
"db": "VULHUB",
"id": "VHN-71367"
},
{
"date": "2014-06-12T00:00:00",
"db": "BID",
"id": "68022"
},
{
"date": "2014-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"date": "2014-06-13T00:12:49",
"db": "PACKETSTORM",
"id": "127081"
},
{
"date": "2014-06-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"date": "2014-07-16T14:19:02.997000",
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-71367"
},
{
"date": "2014-06-12T00:00:00",
"db": "BID",
"id": "68022"
},
{
"date": "2014-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"date": "2014-07-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yealink VoIP Phone In the firmware CRLF Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
}
],
"trust": 0.6
}
}
VAR-201406-0123
Vulnerability from variot - Updated: 2025-04-12 23:28Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. Yealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected. Yealink VoIP P are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. I. ADVISORY
CVE-2014-3427 CRLF Injection in Yealink VoIP Phones CVE-2014-3428 XSS vulnerabilities in Yealink VoIP Phones
Date published: 06/12/2014 Vendor Contacted: 05/08/2014
II. BACKGROUND
Yealink is a manufacturer of VoIP and Video products. To minimize noise read more at:
http://www.yealink.com/Companyprofile.aspx
III. DESCRIPTION
There are CRLF Injection and XSS vulnerabilities in Yealink VoIP telephones. Validated on
Firmware Version 28.72.0.2 Hardware Version 28.2.0.128.0.0.0
CRLF Injection (Header Splitting) proof of concept:
Request GET /servlet?linepage=1&model=%0d%0a%20 ANYTHING I WANT GOES HERE &p=dsskey&q=load HTTP/1.1
In the above request, attackers can shove in code, webpages, etc. In my tests, I have used javascript, redirects, and even an entire web page shoved into the CRLF vulnerable inputs.
The XSS vulnerability
GET /servlet?jumpto=dsskey&model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22&p=login&q=loginForm HTTP/1.1
Typical Cross Site Scripting.
IV. SOLUTION
Minimize accessibility to the phone's interface.
V. VENDOR CONTACT AND RESPONSE
05/08/2014 E-mailed security@yealink.com (bounced) 05/08/2014 Created an account on Yealink's forum and sent message (no response for weeks) 05/26/2014 Response via e-mail from Yealink 05/26/2014 Replied to vendor I would disclose in June 06/01/2014 Reached back out to vendor for update 06/08/2014 Reached back out to vendor for update 06/11/2014 Rouched out one last time... Crickets 06/12/2014 Advisory
VI. TOOLS USED
Burpsuite, WVS, Firefox
-- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
"Where ignorance is our master, there is no possibility of real peace" - Dalai Lama
42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201406-0123",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "voip phone",
"scope": "eq",
"trust": 2.4,
"vendor": "yealink",
"version": "28.72.0.2"
},
{
"model": "voip phone",
"scope": "eq",
"trust": 1.8,
"vendor": "yealink",
"version": "28.2.0.128.0.0.0"
},
{
"model": "hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "28.2.0.128.0.0.0"
},
{
"model": "yealink",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "28.72.0.2"
}
],
"sources": [
{
"db": "BID",
"id": "68023"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:yealink:voip_phone",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:yealink:voip_phone_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jesus Oquendo",
"sources": [
{
"db": "BID",
"id": "68023"
},
{
"db": "PACKETSTORM",
"id": "127081"
}
],
"trust": 0.4
},
"cve": "CVE-2014-3428",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2014-3428",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-71368",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-3428",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-3428",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201406-324",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-71368",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71368"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. \nYealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected. Yealink VoIP P are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. \nI. \tADVISORY\n\nCVE-2014-3427 CRLF Injection in Yealink VoIP Phones\nCVE-2014-3428 XSS vulnerabilities in Yealink VoIP Phones\n\nDate published:\t06/12/2014\nVendor Contacted: 05/08/2014\n\n\nII. \tBACKGROUND\n\nYealink is a manufacturer of VoIP and Video products. To\nminimize noise read more at:\n\nhttp://www.yealink.com/Companyprofile.aspx\n\n\nIII. \tDESCRIPTION\n\nThere are CRLF Injection and XSS vulnerabilities in Yealink\nVoIP telephones. Validated on \n\nFirmware Version 28.72.0.2\nHardware Version 28.2.0.128.0.0.0\n\nCRLF Injection (Header Splitting) proof of concept:\n\nRequest\nGET /servlet?linepage=1\u0026model=%0d%0a%20 ANYTHING I WANT GOES HERE \u0026p=dsskey\u0026q=load HTTP/1.1\n\nIn the above request, attackers can shove in code, webpages,\netc. In my tests, I have used javascript, redirects, and even\nan entire web page shoved into the CRLF vulnerable inputs. \n\n\n-----\n\n\nThe XSS vulnerability\n\nGET /servlet?jumpto=dsskey\u0026model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22\u0026p=login\u0026q=loginForm HTTP/1.1\n\nTypical Cross Site Scripting. \n\n\nIV. \tSOLUTION\n\nMinimize accessibility to the phone\u0027s interface. \n\n\nV. \tVENDOR CONTACT AND RESPONSE\n\n05/08/2014\tE-mailed security@yealink.com (bounced)\n05/08/2014\tCreated an account on Yealink\u0027s forum and\n\t\tsent message (no response for weeks)\n05/26/2014\tResponse via e-mail from Yealink\n05/26/2014\tReplied to vendor I would disclose in June\n06/01/2014\tReached back out to vendor for update\n06/08/2014\tReached back out to vendor for update\n06/11/2014\tRouched out one last time... Crickets\n06/12/2014\tAdvisory\n\n\nVI. \tTOOLS USED\n\nBurpsuite, WVS, Firefox\n\n\n\n-- \n=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\nJ. Oquendo\nSGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM\n\n\"Where ignorance is our master, there is no possibility of\nreal peace\" - Dalai Lama\n\n42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF\nhttp://pgp.mit.edu:11371/pks/lookup?op=get\u0026search=0x2BF7D83F210A95AF\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3428"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "BID",
"id": "68023"
},
{
"db": "VULHUB",
"id": "VHN-71368"
},
{
"db": "PACKETSTORM",
"id": "127081"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-71368",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71368"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-3428",
"trust": 2.9
},
{
"db": "BID",
"id": "68023",
"trust": 2.0
},
{
"db": "PACKETSTORM",
"id": "127081",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-71368",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71368"
},
{
"db": "BID",
"id": "68023"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"id": "VAR-201406-0123",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-71368"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-12T23:28:55.431000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.yealink.com/index.aspx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71368"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/68023"
},
{
"trust": 1.4,
"url": "http://www.securityfocus.com/archive/1/archive/1/532410/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/532410/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2014/jun/74"
},
{
"trust": 1.1,
"url": "http://packetstormsecurity.com/files/127081/yealink-voip-phones-xss-crlf-injection.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3428"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3428"
},
{
"trust": 0.3,
"url": "www.yealink.com"
},
{
"trust": 0.1,
"url": "http://www.yealink.com/companyprofile.aspx"
},
{
"trust": 0.1,
"url": "http://pgp.mit.edu:11371/pks/lookup?op=get\u0026search=0x2bf7d83f210a95af"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3428"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3427"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71368"
},
{
"db": "BID",
"id": "68023"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-71368"
},
{
"db": "BID",
"id": "68023"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-16T00:00:00",
"db": "VULHUB",
"id": "VHN-71368"
},
{
"date": "2014-06-12T00:00:00",
"db": "BID",
"id": "68023"
},
{
"date": "2014-06-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"date": "2014-06-13T00:12:49",
"db": "PACKETSTORM",
"id": "127081"
},
{
"date": "2014-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"date": "2014-06-16T18:55:09.010000",
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-71368"
},
{
"date": "2014-06-12T00:00:00",
"db": "BID",
"id": "68023"
},
{
"date": "2014-06-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002944"
},
{
"date": "2014-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-324"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-3428"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yealink VoIP Phone Firmware cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002944"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-324"
}
],
"trust": 0.7
}
}