Unscored severity · published Jun 16, 2014
CVE-2014-3428
Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Voip Phone · Yealink
28.2.0.128.0.0.0 · source: NVD
VP
Voip Phone Firmware · Yealink
28.72.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3428
Exploit
http://packetstormsecurity.com/files/127081/Yealink-VoIP-Phones-XSS-CRLF-Injection.html
seclists.org
http://seclists.org/fulldisclosure/2014/Jun/74
www.securityfocus.com
http://www.securityfocus.com/archive/1/532410/100/0/threaded
Exploit
http://www.securityfocus.com/bid/68023