Sign-up

ID

VAR-201407-0011


CVE

CVE-2013-5755


TITLE

Yealink IP Phone SIP-T38G of config/.htpasswd Vulnerabilities that gain access

Trust: 0.8

sources: JVNDB: JVNDB-2013-006615

DESCRIPTION

config/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA) for the user account, (2) admin (uoCbM.VEiKQto) for the admin account, and (3) var (jhl3iZAe./qXM) for the var account, which makes it easier for remote attackers to obtain access via unspecified vectors. Yealink VoIP Phone SIP-T38G is an enterprise HD IP phone. Yealink VoIP Phone SIP-T38G has a security credential security bypass vulnerability. The Yealink VoIP Phone SIP-T38G WEB interface uses authentication credentials in /config/.htpasswd, such as: user:user, admin:admin, var:var, to allow attacks. These credentials are used for unauthorized access. Successful attacks can allow a remote attacker to gain access to the vulnerable device

Trust: 2.43

sources: NVD: CVE-2013-5755 // JVNDB: JVNDB-2013-006615 // CNVD: CNVD-2014-03774 // BID: 68051

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-03774

AFFECTED PRODUCTS

vendor:yealinkmodel:sip-t38gscope:eqversion: -

Trust: 1.6

vendor:yealinkmodel:sip-t38gscope: - version: -

Trust: 0.8

vendor:yealinkmodel:voip phone sip-t38gscope: - version: -

Trust: 0.6

vendor:yealinkmodel:sip-t38gscope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2014-03774 // BID: 68051 // JVNDB: JVNDB-2013-006615 // CNNVD: CNNVD-201406-643 // NVD: CVE-2013-5755

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-5755
value: HIGH

Trust: 1.0

NVD: CVE-2013-5755
value: HIGH

Trust: 0.8

CNVD: CNVD-2014-03774
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201406-643
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2013-5755
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: CVE-2013-5755
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:C/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2014-03774
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2014-03774 // JVNDB: JVNDB-2013-006615 // CNNVD: CNNVD-201406-643 // NVD: CVE-2013-5755

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.8

sources: JVNDB: JVNDB-2013-006615 // NVD: CVE-2013-5755

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201406-643

TYPE

trust management

Trust: 0.6

sources: CNNVD: CNNVD-201406-643

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-006615

PATCH
title:Gigabit Color IP Phone SIP-T38Gurl:http://www.yealink.com/product_info.aspx?ProductsCateID=182&CateId=147&BaseInfoCateId=182&Cate_Id=182&parentcateid=147
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-006615

EXTERNAL IDS
db:NVDid:CVE-2013-5755
Trust: 3.3
db:EXPLOIT-DBid:33739
Trust: 3.0
db:BIDid:68051
Trust: 1.5
db:JVNDBid:JVNDB-2013-006615
Trust: 0.8
db:EXPLOITDBid:33739
Trust: 0.6
db:CNVDid:CNVD-2014-03774
Trust: 0.6
db:CNNVDid:CNNVD-201406-643
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03774 // 
            
            
            
            BID: 68051 // 
            
            
            
            JVNDB: JVNDB-2013-006615 // 
            
            
            
            CNNVD: CNNVD-201406-643 // 
            
            
            
            NVD: CVE-2013-5755

REFERENCES
url:http://www.exploit-db.com/exploits/33739
Trust: 1.6
url:http://www.exploit-db.com/exploits/33739/
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5755
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-5755
Trust: 0.8
url:http://www.securityfocus.com/bid/68051
Trust: 0.6
url:http://www.yealink.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2014-03774 // 
            
            
            
            BID: 68051 // 
            
            
            
            JVNDB: JVNDB-2013-006615 // 
            
            
            
            CNNVD: CNNVD-201406-643 // 
            
            
            
            NVD: CVE-2013-5755

CREDITS
Mr.Un1k0d3r & Doreth.Z10
Trust: 0.9
sources:
            
            
            BID: 68051 // 
            
            
            
            CNNVD: CNNVD-201406-643

SOURCES
db:CNVDid:CNVD-2014-03774
db:BIDid:68051
db:JVNDBid:JVNDB-2013-006615
db:CNNVDid:CNNVD-201406-643
db:NVDid:CVE-2013-5755

LAST UPDATE DATE
2025-04-12T23:18:59.298000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03774date:2014-06-20T00:00:00
db:BIDid:68051date:2014-06-13T00:00:00
db:JVNDBid:JVNDB-2013-006615date:2014-07-17T00:00:00
db:CNNVDid:CNNVD-201406-643date:2014-07-17T00:00:00
db:NVDid:CVE-2013-5755date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-03774date:2014-06-20T00:00:00
db:BIDid:68051date:2014-06-13T00:00:00
db:JVNDBid:JVNDB-2013-006615date:2014-07-17T00:00:00
db:CNNVDid:CNNVD-201406-643date:2014-06-30T00:00:00
db:NVDid:CVE-2013-5755date:2014-07-16T14:19:02.823