CVE-2012-1417 - CVE House
Back to Database
Status published Low CVE-2012-1417

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-1417

Credits & Attribution

No credits recorded in the NVD database.

References

More from yealink

View All →
CVE-2022-48625
Yealink Config Encrypt Tool add RSA before 1.2 has a...
Unknown 0
CVE-2021-27561
Yealink Device Management (DM) 3.6.0.20 allows command injection as root...
Unknown 0
CVE-2020-24113
Directory Traversal vulnerability in Contacts File Upload Interface in Yealink...
Critical 9.1
CVE-2018-16221
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone...
High 8
CVE-2018-16218
A CSRF (Cross Site Request Forgery) in the web interface...
High 8.8

Affected Vendor

Affected Software

gigabit color ip phone sip-t32g, gigabit color ip phone sip-t38g, ip phone sip-t19p, ip phone sip-t20p, ip phone sip-t21p, ip phone sip-t22p, ip phone sip-t26p, ip phone sip-t28p, ip video phone vp530, ultra-elegant ip phone sip-t41p, ultra-elegant ip phone sip-t42g, ultra-elegant ip phone sip-t46g, ultra-elegant ip phone sip-t48g, w52p
Vulnerable Versions:
Unknown

Timeline

Official Publish: September 17th, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.