What’s Vulnerable › Vulnerabilities

CVE-2012-1417

• Severity: low (CVSS 3.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-09-17 · updated 2026-06-16
• Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

Affected products

• Yealink Gigabit Color Ip Phone Sip-T32G: all versions
• Yealink Gigabit Color Ip Phone Sip-T38G: all versions
• Yealink Ip Phone Sip-T19P: all versions
• Yealink Ip Phone Sip-T20P: all versions
• Yealink Ip Phone Sip-T21P: all versions
• Yealink Ip Phone Sip-T22P: all versions
• Yealink Ip Phone Sip-T26P: all versions
• Yealink Ip Phone Sip-T28P: all versions
• Yealink Ip Video Phone Vp530: all versions
• Yealink Ultra-Elegant Ip Phone Sip-T41P: all versions
• Yealink Ultra-Elegant Ip Phone Sip-T42G: all versions
• Yealink Ultra-Elegant Ip Phone Sip-T46G: all versions
• Yealink Ultra-Elegant Ip Phone Sip-T48G: all versions
• Yealink W52P: all versions

References

• http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html
• http://packetstormsecurity.org/files/110320/yealink-xss.txt
• http://secunia.com/advisories/48194
• http://www.exploit-db.com/exploits/18540
• http://www.osvdb.org/79675
• http://www.securityfocus.com/bid/52209
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73573
• http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html
• http://packetstormsecurity.org/files/110320/yealink-xss.txt
• http://secunia.com/advisories/48194
• http://www.exploit-db.com/exploits/18540
• http://www.osvdb.org/79675

Get alerted when CVE-2012-1417 or the next vulnerability affects your stack