CVE:CVE-2012-1417
CNNVD:CNNVD-201202-515
Yealink VoIP Phones是中国亿联（YeaLink）公司的IP话机产品。该产品支持来电人头像显示、通话录音和匿名呼叫等。
Yealink VOIP Phone中的Local Phone book和Blacklist form存在跨站脚本漏洞，该漏洞源于cgi-bin/ConfigManApp.com URL没有充分过滤‘user’字段。远程攻击者可利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade yealink gigabit_color_ip_phone_sip-t32g to a higher version than -; Upgrade yealink gigabit_color_ip_phone_sip-t38g to a higher version than -; Upgrade yealink ip_phone_sip-t19p to a higher version than -; Upgrade yealink ip_phone_sip-t20p to a higher version than -; Upgrade yealink ip_phone_sip-t21p to a higher version than -; Upgrade yealink ip_phone_sip-t22p to a higher version than -; Upgrade yealink ip_phone_sip-t26p to a higher version than -; Upgrade yealink ip_phone_sip-t28p to a higher version than -; Upgrade yealink ip_video_phone_vp530 to a higher version than -; Upgrade yealink ultra-elegant_ip_phone_sip-t41p to a higher version than -; Upgrade yealink ultra-elegant_ip_phone_sip-t42g to a higher version than -; Upgrade yealink ultra-elegant_ip_phone_sip-t46g to a higher version than -; Upgrade yealink ultra-elegant_ip_phone_sip-t48g to a higher version than -; Upgrade yealink w52p to a higher version than -