CVE-2024-28442

Published: Mar 26, 2024Modified: Jul 30, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use function in the company portal component.

Affected (1)

Products: Yealink: Vp59 Firmware

Yealink

1 product

Vp59 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yealink Vp59 Firmware	Version 91.15.0.118

Running on/with	Platform Versions
Yealink Vp59	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://medium.com/%40deepsahu1/cve-2024-28442-yealink-ip-phone-webview-escape-leads-to-sensitive-file-disclosure-via-directory-686ef8f80227

Source: cve@mitre.org

ExploitPermissions RequiredThird Party Advisory

https://www.yealink.com/en/product-detail/ip-phone-vp59

Source: cve@mitre.org

Product

https://medium.com/%40deepsahu1/cve-2024-28442-yealink-ip-phone-webview-escape-leads-to-sensitive-file-disclosure-via-directory-686ef8f80227

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPermissions RequiredThird Party Advisory

https://www.yealink.com/en/product-detail/ip-phone-vp59

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.