Unscored severity · published Sep 17, 2014
CVE-2012-1417
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Gigabit Color IP Phone Sip-t32g · Yealink
All versions, or not specified · source: NVD
GC
Gigabit Color IP Phone Sip-t38g · Yealink
All versions, or not specified · source: NVD
IP
IP Phone Sip-t19p · Yealink
All versions, or not specified · source: NVD
IP
IP Phone Sip-t20p · Yealink
All versions, or not specified · source: NVD
IP
IP Phone Sip-t21p · Yealink
All versions, or not specified · source: NVD
IP
IP Phone Sip-t22p · Yealink
All versions, or not specified · source: NVD
IP
IP Phone Sip-t26p · Yealink
All versions, or not specified · source: NVD
IP
IP Phone Sip-t28p · Yealink
All versions, or not specified · source: NVD
IV
IP Video Phone Vp530 · Yealink
All versions, or not specified · source: NVD
UI
Ultra-elegant IP Phone Sip-t41p · Yealink
All versions, or not specified · source: NVD
UI
Ultra-elegant IP Phone Sip-t42g · Yealink
All versions, or not specified · source: NVD
UI
Ultra-elegant IP Phone Sip-t46g · Yealink
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1417
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1417
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html
Exploit
http://packetstormsecurity.org/files/110320/yealink-xss.txt
secunia.com
http://secunia.com/advisories/48194
Exploit
http://www.exploit-db.com/exploits/18540
www.osvdb.org
http://www.osvdb.org/79675
www.securityfocus.com
http://www.securityfocus.com/bid/52209