CVE-2025-14228: Yealink SIP-T21P E2 Local Directory cross site scripting
A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14228?
CVE-2025-14228 is classified with a severity score that indicates a significant security risk due to its potential for remote exploitation.
How do I fix CVE-2025-14228?
To mitigate CVE-2025-14228, users should update the Yealink SIP-T21P E2 firmware to a patched version provided by the vendor.
What kind of attack can exploit CVE-2025-14228?
CVE-2025-14228 can be exploited to perform cross-site scripting attacks remotely.
Which component is affected by CVE-2025-14228?
The affected component in CVE-2025-14228 is the Local Directory Page of the Yealink SIP-T21P E2.
Is it possible to exploit CVE-2025-14228 remotely?
Yes, CVE-2025-14228 allows for remote exploitation, making it critical to address the vulnerability promptly.