CVEvulnerability
CVE-2012-1417
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.
Affected configurations
• yealink gigabit color ip phone sip-t32g
• yealink gigabit color ip phone sip-t38g
• yealink ip phone sip-t19p
• yealink ip phone sip-t20p
• yealink ip phone sip-t21p
• yealink ip phone sip-t22p
• yealink ip phone sip-t26p
• yealink ip phone sip-t28p
• yealink ip video phone vp530
• yealink ultra-elegant ip phone sip-t41p
• yealink ultra-elegant ip phone sip-t42g
• yealink ultra-elegant ip phone sip-t46g
• yealink ultra-elegant ip phone sip-t48g
• yealink w52p
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html archives.neohapsis.com
- http://packetstormsecurity.org/files/110320/yealink-xss.txt Exploit
- http://secunia.com/advisories/48194 secunia.com
- http://www.exploit-db.com/exploits/18540 Exploit
- http://www.osvdb.org/79675 www.osvdb.org
- http://www.securityfocus.com/bid/52209 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73573 exchange.xforce.ibmcloud.com
- http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html archives.neohapsis.com
- http://packetstormsecurity.org/files/110320/yealink-xss.txt Exploit
- http://secunia.com/advisories/48194 secunia.com
- http://www.exploit-db.com/exploits/18540 Exploit
- http://www.osvdb.org/79675 www.osvdb.org
- http://www.securityfocus.com/bid/52209 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73573 exchange.xforce.ibmcloud.com