Unscored severity · published Jul 16, 2014
CVE-2014-3427
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks…
–
CVSS
5.2%
EPSS
No
On KEV
Description
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Voip Phone Firmware · Yealink
28.72.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3427
Exploit
http://packetstormsecurity.com/files/127081/Yealink-VoIP-Phones-XSS-CRLF-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Jun/74
www.securityfocus.com
http://www.securityfocus.com/archive/1/532410/100/0/threaded
More from Voip Phone Firmware
–
CVE-2014-3428
Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to…