Unrated severityNVD Advisory· Published Oct 8, 2019· Updated Aug 5, 2024
CVE-2019-14657
CVE-2019-14657
Description
Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.
Affected products
2- Yealink/phonesdescription
Patches
Vulnerability mechanics
References
2- cerebusforensics.com/yealink/exploit.htmlmitrex_refsource_MISC
- sway.office.com/3pCb559LYVuT0eigmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.