Yealink SIP-T21P E2 Cross-Site Scripting Vulnerability in Local Directory Page

A cross-site scripting vulnerability has been identified in the Yealink SIP-T21P E2 IP phone software version 52.84.0.15. The issue arises from an unknown function in the Local Directory Page component, where user input is not properly sanitized before being outputted as a web page, allowing authenticated attackers to execute arbitrary HTML or JavaScript in the context of the user's browser. This vulnerability can be exploited remotely and has been made public.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.