CVE-2012-1417: Yealink Gigabit Color IP Phone SIP-t32g

Low severity, CVSS 3.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

Affected products

• Yealink Gigabit Color IP Phone SIP-t32g: affected versions not specified
• Yealink Gigabit Color IP Phone SIP-t38g: affected versions not specified
• Yealink IP Phone SIP-t19p: affected versions not specified
• Yealink IP Phone SIP-t20p: affected versions not specified
• Yealink IP Phone SIP-t21p: affected versions not specified
• Yealink IP Phone SIP-t22p: affected versions not specified
• Yealink IP Phone SIP-t26p: affected versions not specified
• Yealink IP Phone SIP-t28p: affected versions not specified
• Yealink IP Video Phone VP530: affected versions not specified
• Yealink Ultra-Elegant IP Phone SIP-t41p: affected versions not specified
• Yealink Ultra-Elegant IP Phone SIP-t42g: affected versions not specified
• Yealink Ultra-Elegant IP Phone SIP-t46g: affected versions not specified
• Yealink Ultra-Elegant IP Phone SIP-t48g: affected versions not specified
• Yealink w52p: affected versions not specified

Published 2014-09-17. Last modified 2026-06-16.