CVE-2019-14656

Yealink phones through 2019-08-04 do not properly check user roles in POST requests

published October 8, 2019

CVSS
—
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01984 · 80.4th percentile
Published
2019-10-08T12:01Z
EPSS history
Timeline
  • 08 OCT 12:01Z
    Yealink phones through 2019-08-04 do not properly check user roles in POST requests
    cvelistv5