Executive Summary

This vulnerability is a cross-site scripting (XSS) weakness found in the Local Directory Page component of the Yealink SIP-T21P E2 device running version 52.84.0.15. It allows an attacker to remotely manipulate the component to execute malicious scripts in the context of the affected device's interface. The vulnerability affects only unsupported products, and the vendor did not respond to the disclosure.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to perform cross-site scripting attacks remotely, potentially leading to unauthorized script execution within the device's interface. This could be used to manipulate the device's behavior or steal information accessible through the Local Directory Page. However, the impact is limited as the vulnerability does not affect confidentiality or availability, only integrity to a limited extent, and requires some user interaction and privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Since the affected Yealink SIP-T21P E2 devices are no longer supported by the maintainer and the vendor did not respond to the disclosure, immediate mitigation steps include restricting network access to the device, especially limiting remote access to the Local Directory Page functionality, and monitoring for any suspicious activity. Consider isolating the device from untrusted networks and applying any available network-level protections such as web application firewalls or intrusion prevention systems to block potential cross-site scripting attempts.

Useful 0 Not Useful 0