header-logo
Suggest Exploit
vendor:
VoIP Phones
by:
SecurityFocus
4,3
CVSS
MEDIUM
HTTP-Response-Splitting
113
CWE
Product Name: VoIP Phones
Affected Version From: Firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2013

Yealink VoIP Phones HTTP-Response-Splitting Vulnerability

Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Mitigation:

Input validation should be used to ensure that untrusted data is not allowed to influence the HTTP response headers.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/68022/info

Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Yealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected. 

GET /servlet?linepage=1&model=%0d%0a[Header]&p=dsskey&q=load

Navigation

Suggest Exploit

Services By CQR