Lucene search
HistoryJul 16, 2014 - 2:19 p.m.
CVE-2014-3427
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
7
Confidence
Low
EPSS
0.035
Percentile
91.6%
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet.
Affected configurations
Node
yealinkvoip_phone_firmwareMatch28.72.0.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| yealink | voip_phone_firmware | 28.72.0.2 | cpe:2.3:o:yealink:voip_phone_firmware:28.72.0.2:*:*:*:*:*:*:* |
Related
prion
prion
Crlf injection
2014-07-16 14:19:00
cve
cve
CVE-2014-3427
2014-07-16 14:19:02
exploitdb
exploitdb
Yealink VoIP Phones - '/servlet' HTTP Response Splitting
2014-06-12 00:00:00
cvelist
cvelist
CVE-2014-3427
2014-07-16 14:00:00
securityvulns
securityvulns
CVE-2014-3427 CRLF Injection and CVE-2014-3428 XSS Injection in Yealink VoIP Phones
2014-06-13 00:00:00
Yealink VoIP phones security vulnerabilities
2014-06-13 00:00:00
packetstorm
packetstorm
Yealink VoIP Phones XSS / CRLF Injection
2014-06-13 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
7
Confidence
Low
EPSS
0.035
Percentile
91.6%
Related for NVD:CVE-2014-3427