CVE-2018-16221 - CVE House
Back to Database
Status published High CVE-2018-16221

The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone...

Vulnerability Description

The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path traversal), which allows an authenticated remote attacker to get access to privileged information (e.g., /etc/passwd) via path traversal (relative path information in the file parameter of the corresponding POST request).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16221

Credits & Attribution

No credits recorded in the NVD database.

References

More from yealink

View All →
CVE-2022-48625
Yealink Config Encrypt Tool add RSA before 1.2 has a...
Unknown 0
CVE-2021-27561
Yealink Device Management (DM) 3.6.0.20 allows command injection as root...
Unknown 0
CVE-2020-24113
Directory Traversal vulnerability in Contacts File Upload Interface in Yealink...
Critical 9.1
CVE-2018-16218
A CSRF (Cross Site Request Forgery) in the web interface...
High 8.8
CVE-2018-16217
The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP...
High 8.8

Affected Vendor

Affected Software

ultra-elegant ip phone sip-t41p firmware
Vulnerable Versions:
66.83.0.35

Timeline

Official Publish: May 29th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.