High severity · published May 29, 2019
CVE-2018-16221
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path traversal), which allows…
8.0
CVSS
1.5%
EPSS
No
On KEV
Description
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path traversal), which allows an authenticated remote attacker to get access to privileged information (e.g., /etc/passwd) via path traversal (relative path information in the file parameter of the corresponding POST request).
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UI
Ultra-elegant IP Phone Sip-t41p Firmware · Yealink
66.83.0.35 · source: NVD
Affected product
UI
Ultra-elegant IP Phone Sip-t41p Firmware
Yealink
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16221
Third Party Advisory
https://www.sit.fraunhofer.de/de/securitytestlab/
Third Party Advisory
https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Yealink_Ultra-elegantIPPhone_SIPT41P.pdf?_=1549375271
More from Ultra-elegant IP Phone Sip-t41p Firmware
8.8
CVE-2018-16218
A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker to trigger code…
8.8
CVE-2018-16217
The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open…