Path traversal

Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...

CVE-2013-5757

Yealink VoIP Phone SIP-T38G is affected by CVE-2013-5757 (absolute path traversal) via the cgiServer.exx command parameter (dumpConfigFile). The vulnerability allows remote authenticated users to read arbitrary files by supplying a full pathname, with corroborating references describing /etc/pass...