CVE-2025-14228
BaseFortify
Publication date: 2025-12-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yealink | sip-t21p_e2 | 52.84.0.15 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) weakness found in the Local Directory Page component of the Yealink SIP-T21P E2 device running version 52.84.0.15. It allows an attacker to remotely manipulate the component to execute malicious scripts in the context of the affected device's interface. The vulnerability affects only unsupported products, and the vendor did not respond to the disclosure.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to perform cross-site scripting attacks remotely, potentially leading to unauthorized script execution within the device's interface. This could be used to manipulate the device's behavior or steal information accessible through the Local Directory Page. However, the impact is limited as the vulnerability does not affect confidentiality or availability, only integrity to a limited extent, and requires some user interaction and privileges.
What immediate steps should I take to mitigate this vulnerability?
Since the affected Yealink SIP-T21P E2 devices are no longer supported by the maintainer and the vendor did not respond to the disclosure, immediate mitigation steps include restricting network access to the device, especially limiting remote access to the Local Directory Page functionality, and monitoring for any suspicious activity. Consider isolating the device from untrusted networks and applying any available network-level protections such as web application firewalls or intrusion prevention systems to block potential cross-site scripting attempts.