| Yealink SIP-T38G (SIP-T38G)
|
|
Security Grade
Calculator v1
|
Yealink SIP-T38G (SIP-T38G)
Category: IP Phone • Model / Gen: SIP-T38G
Release Date: 2011-01-01 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
—
|
No published hardware-tampering research specific to this model was found as of 2026-10. The desk phone housing is screwed shut and exposes no serviceable port from outside.
|
| Known vulnerabilities
|
Rare
|
[https://nvd.nist.gov/vuln/detail/CVE-2013-5755
https://nvd.nist.gov/vuln/detail/CVE-2013-5758 🔗 Proof]
|
Four CVEs list sip-t38g directly. CVE-2013-5755 documents hardcoded credentials baked into config/.htpasswd (user:s7C9Cx.rLsWFA, admin:uoCbM.VEiKQto, var:jhl3iZAe./qXM). CVE-2013-5758 allows an authenticated user to run arbitrary commands through the system method in cgi-bin/cgiServer.exx, and CVE-2013-5756 / CVE-2013-5757 allow arbitrary file reads via path traversal.
|
| Prior attacks
|
None
|
—
|
No campaign naming this model was found. The CVEs date from 2013 and the product is end of life, so any large-scale exploitation would have been historical rather than current. Provisional value.
|
| Updatability
|
None
|
🔗 Proof
|
The SIP-T38G is end of life. Yealink no longer issues firmware for it, so the hardcoded credentials and the command-execution flaws documented in 2013 cannot be fixed by any update, only mitigated by isolating the phone.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Because the admin password is hardcoded and the same on every unit, any party who knows the published string can authenticate to the phone, so no meaningful authentication protects the device-to-system channel.
|
| Communications
|
No encryption
|
—
|
Web management runs over plaintext HTTP and SIP signalling typically over UDP without TLS; neither is enforced by default. Provisional value, not directly evidenced for this model.
|
| Storage
|
No encryption
|
—
|
SIP account credentials and the provisioning data are stored in phone flash without documented encryption. Provisional value, not directly evidenced for this model.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
—
|
A fixed admin/user split managed through provisioning, without granular roles. Provisional value, not directly evidenced for this model.
|
| Authentication
|
Absent
|
🔗 Proof
|
Login exists, but CVE-2013-5755 shows the admin and user passwords are hardcoded constants identical across every unit, which reduces authentication to a publicly known string.
|
| Brute-force protection
|
Absent
|
—
|
No documented lockout or rate limiting, and brute force is irrelevant anyway because the password is a published constant. Provisional value.
|
| Event logging
|
Partial logging
|
—
|
A local log is viewable in the web interface, with no centralised or tamper-evident logging. Provisional value, not directly evidenced for this model.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Hardcoded, non-changeable-then-updatable passwords are shipped in config/.htpasswd: user:s7C9Cx.rLsWFA and admin:uoCbM.VEiKQto. This is the textbook default-credential failure and the product receives no further firmware.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Linux (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Ethernet (RJ45), PoE
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
The Yealink SIP-T38G is an enterprise SIP desk phone, now end of life. Its vulnerability record is old but unusually stark: CVE-2013-5755 documents hardcoded passwords shipped in config/.htpasswd, with the admin account fixed at the literal string uoCbM.VEiKQto on every unit. CVE-2013-5758 allows an authenticated user to run arbitrary shell commands through the system method in cgiServer.exx, and CVE-2013-5756 and CVE-2013-5757 allow arbitrary file reads via path traversal. NVD lists sip-t38g explicitly in all four CPE sets, so these are model-level findings. The critical point is that the product is end of life and receives no firmware, so the hardcoded credential can never be patched; it can only be mitigated by firewall isolation. The device is rated D. It is not rated F because the flaws are not remotely exploitable without credentials in the way CVE-2021-36260 was on the Hikvision camera, the published research is from 2013 and no current campaign was found, and the primary exposure is a fixed password rather than an unauthenticated memory-corruption path. Values for hardware tampering, prior attacks, communications encryption, storage encryption, account management, brute-force protection and event logging are provisional because no model-level Yealink documentation could be retrieved; the rating rests on the four CVE records.
