CVE-2013-5758
50Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 12%
from disclosure to weapon0 days
Published on NVDAug 3
1st PoCJun 13
VulnCheck+1775d
exploitation probability
12%top 4% of all CVEs
observed exploitation
yesVulnCheck
6 public exploit(s)
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files.
Affected products
n/a · n/apublic PoCs found — 6
cve_referencepacketstormsecurity.com/files/127093/Yealink-VoIP-Phone-SIP-T38G-Privilege-Escalation.htmlunverifiedcve_referencepacketstormsecurity.com/files/127096/Yealink-VoIP-Phone-SIP-T38G-Remote-Command-Execution.htmlunverifiedcve_referencewww.exploit-db.com/exploits/33741unverifiedcve_referencewww.exploit-db.com/exploits/33742unverifiedexploitdbwww.exploit-db.com/exploits/33742unverifiedexploitdbwww.exploit-db.com/exploits/33741unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/127093/Yealink-VoIP-Phone-SIP-T38G-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/127096/Yealink-VoIP-Phone-SIP-T38G-Remote-Command-Execution.htmlhttp://www.exploit-db.com/exploits/33741http://www.exploit-db.com/exploits/33742http://www.osvdb.org/108080