CVE-2018-16221
EUVD-2018-807329.05.2019, 18:29
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path traversal), which allows an authenticated remote attacker to get access to privileged information (e.g., /etc/passwd) via path traversal (relative path information in the file parameter of the corresponding POST request).
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| yealink | ultra-elegant_ip_phone_sip-t41p_firmware | 66.83.0.35 |
𝑥
= Vulnerable software versions
References