CVE-2013-5758

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files.

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

11.89% chance of exploitation in the next 30 days, 96th percentile

Published

2014-08-03

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://www.exploit-db.com/exploits/33741
• http://www.exploit-db.com/exploits/33742

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/33742
• https://www.exploit-db.com/exploits/33741

References

• CVE Record
• NVD entry

Related

• CVE-2013-5757
• CVE-2013-5791
• CVE-2013-5756
• CVE-2013-5795
• CVE-2013-5755
• CVE-2013-5842