High severity · published May 29, 2019
CVE-2018-16217
The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open…
8.8
CVSS
3.3%
EPSS
No
On KEV
Description
The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open a reverse shell via command injection.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UI
Ultra-elegant IP Phone Sip-t41p Firmware · Yealink
66.83.0.35 · source: NVD
Affected product
UI
Ultra-elegant IP Phone Sip-t41p Firmware
Yealink
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16217
Third Party Advisory
https://www.sit.fraunhofer.de/de/securitytestlab/
Third Party Advisory
https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Yealink_Ultra-elegantIPPhone_SIPT41P.pdf?_=1549375271
More from Ultra-elegant IP Phone Sip-t41p Firmware
8.8
CVE-2018-16218
A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker to trigger code…
8.0
CVE-2018-16221
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path traversal), which allows…