Details of VAR-201305-0468

ID

VAR-201305-0468

TITLE

YeaLink IP Phone SIP-T20P/SIP-T26P Security Bypass Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2013-06423 // CNNVD: CNNVD-201305-621

DESCRIPTION

The YeaLink IP Phone SIP-T20P/SIP-T26P phone device with firmware version <=9.70.0.100 has a security vulnerability that allows an attacker to use the first available SIP account, call without user confirmation, and the caller can also pass the microphone. monitor. YeaLink IP Phone SIP-T20P and SIP-T26P are both enterprise-grade IP phones from YeaLink of China. SIP-T20P is characterized by easy installation and use, convenient management, and improved office efficiency. It is mainly used for SMEs, call centers, governments and industry users. The feature of SIP-T26P is that it supports VLAN and OPen VPN functions, which is suitable for professional users such as supervisors, front desks, dispatchers, and agents. A security bypass vulnerability exists in YeaLink IP Phone SIP-T20P and SIP-T26P. An attacker could use this vulnerability to bypass specific security restrictions and perform unauthorized operations

Trust: 1.35

sources: CNVD: CNVD-2013-06423 // CNNVD: CNNVD-201305-621 // BID: 60204

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2013-06423

AFFECTED PRODUCTS

vendor:	yealink	model:	ip phone sip-t26p	scope:	-	version:	-	Trust: 0.6
vendor:	yealink	model:	ip phone sip-t20p	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2013-06423

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2013-06423
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2013-06423
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2013-06423

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201305-621

TYPE

Design Error

Trust: 0.3

sources: BID: 60204

EXTERNAL IDS

db:	BID	id:	60204	Trust: 1.5
db:	EXPLOIT-DB	id:	25811	Trust: 0.6
db:	CNVD	id:	CNVD-2013-06423	Trust: 0.6
db:	CNNVD	id:	CNNVD-201305-621	Trust: 0.6

sources: CNVD: CNVD-2013-06423 // BID: 60204 // CNNVD: CNNVD-201305-621

REFERENCES

url:	http://www.exploit-db.com/exploits/25811/	Trust: 0.6
url:	http://www.securityfocus.com/bid/60204	Trust: 0.6
url:	http://yealink.com/product_info.aspx?productscateid=187&cateid=147&baseinfocateid=187&cate_id=187&parentcateid=147	Trust: 0.3
url:	http://yealink.com/product_info.aspx?productscateid=185&cateid=147&baseinfocateid=185&cate_id=185&parentcateid=147	Trust: 0.3

sources: CNVD: CNVD-2013-06423 // BID: 60204 // CNNVD: CNNVD-201305-621

CREDITS

b0hr

Trust: 0.9

sources: BID: 60204 // CNNVD: CNNVD-201305-621

SOURCES

db:	CNVD	id:	CNVD-2013-06423
db:	BID	id:	60204
db:	CNNVD	id:	CNNVD-201305-621

LAST UPDATE DATE

2022-05-17T01:57:50.678000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-06423	date:	2013-06-03T00:00:00
db:	BID	id:	60204	date:	2013-05-29T00:00:00
db:	CNNVD	id:	CNNVD-201305-621	date:	2013-05-30T00:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2013-06423	date:	2013-05-31T00:00:00
db:	BID	id:	60204	date:	2013-05-29T00:00:00
db:	CNNVD	id:	CNNVD-201305-621	date:	2013-05-30T00:00:00