Yealink T21P_E2 Phone Command Injection Vulnerability Allowing Arbitrary Code Execution

A command injection vulnerability has been identified in the Yealink T21P_E2 Phone, specifically in the firmware version 52.84.0.15. This vulnerability allows a remote attacker with normal privileges to execute arbitrary code by sending a crafted request through the ping function of the diagnostic component.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected device, potentially allowing for further exploitation or manipulation of the device's functionality.

Reproduction

To reproduce this vulnerability, log into the phone's web portal and navigate to the 'Network' section, then select 'Diagnostics'. Input a command into the 'cmd' parameter and capture the HTTP traffic using Burp Suite. Append a payload, such as ';id', to the 'cmd' parameter. The appended command will be executed on the device, as demonstrated by the response showing the executed command's output.