Back to Database
Status published
Medium
CVE-2014-3428
Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware...
Vulnerability Description
Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-3428
Credits & Attribution
No credits recorded in the NVD database.
References
More from yealink
View All →CVE-2022-48625
Yealink Config Encrypt Tool add RSA before 1.2 has a...
Unknown
0
CVE-2021-27561
Yealink Device Management (DM) 3.6.0.20 allows command injection as root...
Unknown
0
CVE-2020-24113
Directory Traversal vulnerability in Contacts File Upload Interface in Yealink...
Critical
9.1
CVE-2018-16221
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone...
High
8
CVE-2018-16218
A CSRF (Cross Site Request Forgery) in the web interface...
High
8.8
Affected Vendor
yealink
View all reports →Affected Software
voip phone firmware, voip phone
Vulnerable Versions:
28.72.0.2, 28.2.0.128.0.0.0
Timeline
Official Publish:
June 16th, 2014
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.