CVE-2018-16217: OS Command Injection
The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open a reverse shell via command injection.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-16217?
CVE-2018-16217 is a vulnerability found in the network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) that allows a remote authenticated attacker to trigger OS commands or open a reverse shell via command injection.
How does CVE-2018-16217 affect the Yeahlink Ultra-elegant IP Phone SIP-T41P?
CVE-2018-16217 affects the Yeahlink Ultra-elegant IP Phone SIP-T41P by allowing a remote attacker to trigger OS commands or open a reverse shell through the network diagnostic function (ping).
What is the severity of CVE-2018-16217?
CVE-2018-16217 has a severity score of 8.8, which is classified as critical.
How can I fix the CVE-2018-16217 vulnerability?
To fix the CVE-2018-16217 vulnerability, update the firmware of the Yeahlink Ultra-elegant IP Phone SIP-T41P to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2018-16217?
You can find more information about CVE-2018-16217 at the following references: [sit.fraunhofer.de/securitytestlab](https://www.sit.fraunhofer.de/de/securitytestlab/) and [Advisory_Yealink_Ultra-elegantIPPhone_SIPT41P.pdf](https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Yealink_Ultra-elegantIPPhone_SIPT41P.pdf?_=1549375271).