A vulnerability, which was classified as critical, was found in Yealink Voip Phone 28.72.0.2 (IP Phone Software). Affected is an unknown part of the component Firmware. The manipulation of the argument model with an unknown input leads to a crlf injection vulnerability. CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on integrity. CVE summarizes:

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet.

The weakness was shared 07/16/2014 as not defined posting (Bugtraq). The advisory is available at securityfocus.com. This vulnerability is traded as CVE-2014-3427 since 05/07/2014. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry 70054 is related to this item.

Productinfo

Type

• IP Phone Software

Vendor

• Yealink

Name

• Voip Phone

Version

• 28.72.0.2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion