Yealink – CSRF Vulnerability in Ultra-elegant IP Phone SIP-T41P

Advisory IDRSN-SIP-1623

Vulnerability Information

A CSRF (Cross Site Request Forgery) in the web interface of the Yealink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker to trigger code execution or settings modification on the device by providing a crafted link to the victim.

Technical Information

A CSRF (Cross Site Request Forgery) in the web interface of the Yealink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker to trigger code execution or settings modification on the device by providing a crafted link to the victim.

Solutions

The UCTM solution from RedShift Networks provides the industry’s first complete security solution developed to secure VOIP networks, endpoints and applications. His research team Condor-Labs.com is constantly looking for new attack patterns, advanced penetration testing methods, vulnerability identification and deployment of new signatures for constantly subscribed clients. For more information visit www.redshiftnetworks.com

External Resources

Common Vulnerabilities and Exposures (CVE)