NetSight
IP …
low3.5Public exploit code

CVE-2012-1417

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject ar…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

Affected products

VendorProductAffected versions
YealinkGigabit Color Ip Phone Sip-T32g
All versions
YealinkGigabit Color Ip Phone Sip-T38g
All versions
YealinkIp Phone Sip-T19p
All versions
YealinkIp Phone Sip-T20p
All versions
YealinkIp Phone Sip-T21p
All versions
YealinkIp Phone Sip-T22p
All versions
YealinkIp Phone Sip-T26p
All versions
YealinkIp Phone Sip-T28p
All versions
YealinkIp Video Phone Vp530
All versions
YealinkUltra-Elegant Ip Phone Sip-T41p
All versions
YealinkUltra-Elegant Ip Phone Sip-T42g
All versions
YealinkUltra-Elegant Ip Phone Sip-T46g
All versions

Weakness classification

CWE-79

References