critical9.0Public exploit code
CVE-2013-5758
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body o…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Yealink VoIP Phone SIP-T38G - Privilege Escalation2014-06-13 · remote · hardware
- Yealink VoIP Phone SIP-T38G - Remote Command Execution2014-06-13 · remote · hardware
Impact
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yealink | Sip-T38g | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/127093/Yealink-VoIP-Phone-SIP-T38G-Privilege-Escalation.html
- http://packetstormsecurity.com/files/127096/Yealink-VoIP-Phone-SIP-T38G-Remote-Command-Execution.html
- http://www.exploit-db.com/exploits/33741
- http://www.exploit-db.com/exploits/33742
- http://www.osvdb.org/108080
- http://packetstormsecurity.com/files/127093/Yealink-VoIP-Phone-SIP-T38G-Privilege-Escalation.html
- http://packetstormsecurity.com/files/127096/Yealink-VoIP-Phone-SIP-T38G-Remote-Command-Execution.html
- http://www.exploit-db.com/exploits/33741
- http://www.exploit-db.com/exploits/33742
- http://www.osvdb.org/108080