You do not have permission to edit this page, for the following reasons:
The Yealink SIP-T38G is an enterprise SIP desk phone, now end of life. Its vulnerability record is old but unusually stark: CVE-2013-5755 documents hardcoded passwords shipped in config/.htpasswd, with the admin account fixed at the literal string uoCbM.VEiKQto on every unit. CVE-2013-5758 allows an authenticated user to run arbitrary shell commands through the system method in cgiServer.exx, and CVE-2013-5756 and CVE-2013-5757 allow arbitrary file reads via path traversal. NVD lists sip-t38g explicitly in all four CPE sets, so these are model-level findings. The critical point is that the product is end of life and receives no firmware, so the hardcoded credential can never be patched; it can only be mitigated by firewall isolation. The device is rated D. It is not rated F because the flaws are not remotely exploitable without credentials in the way CVE-2021-36260 was on the Hikvision camera, the published research is from 2013 and no current campaign was found, and the primary exposure is a fixed password rather than an unauthenticated memory-corruption path. Values for hardware tampering, prior attacks, communications encryption, storage encryption, account management, brute-force protection and event logging are provisional because no model-level Yealink documentation could be retrieved; the rating rests on the four CVE records.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
