CVE-2019-14656

2019-10-0812:01:20

mitre

www.cve.org

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

53.2%

JSON

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.

References

cerebusforensics.com/yealink/exploit.html

sway.office.com/3pCb559LYVuT0eig