CVE-2012-1417

Published: Sep 17, 2014Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

Affected (14)

Products: Yealink: Gigabit Color Ip Phone Sip T32g, Gigabit Color Ip Phone Sip T38g, Ip Phone Sip T19p, Ip Phone Sip T20p, Ip Phone Sip T21p, Ip Phone Sip T22p, Ip Phone Sip T26p, Ip Phone Sip T28p, Ip Video Phone Vp530, Ultra Elegant Ip Phone Sip T41p, Ultra Elegant Ip Phone Sip T42g, Ultra Elegant Ip Phone Sip T46g, Ultra Elegant Ip Phone Sip T48g, W52p

Yealink

14 products

Gigabit Color Ip Phone Sip T32g

Gigabit Color Ip Phone Sip T38g

Ultra Elegant Ip Phone Sip T41p

Ultra Elegant Ip Phone Sip T42g

Ultra Elegant Ip Phone Sip T46g

Ultra Elegant Ip Phone Sip T48g

W52p

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Yealink Gigabit Color Ip Phone Sip T32g	All versions
Yealink Gigabit Color Ip Phone Sip T38g	All versions
Yealink Ip Phone Sip T19p	All versions
Yealink Ip Phone Sip T20p	All versions
Yealink Ip Phone Sip T21p	All versions
Yealink Ip Phone Sip T22p	All versions
Yealink Ip Phone Sip T26p	All versions
Yealink Ip Phone Sip T28p	All versions
Yealink Ip Video Phone Vp530	All versions
Yealink Ultra Elegant Ip Phone Sip T41p	All versions
Yealink Ultra Elegant Ip Phone Sip T42g	All versions
Yealink Ultra Elegant Ip Phone Sip T46g	All versions
Yealink Ultra Elegant Ip Phone Sip T48g	All versions
Yealink W52p	All versions