CVE-2025-14228

LOW

Yealink SIP-T21P E2 52.84.0.15 - Cross-Site Scripting in Local Directory Page

Title source: llm
STIX 2.1

Description

A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry
https://vuldb.com/?id.334670
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.334670
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.701949

Scores

CVSS v3 3.5
EPSS 0.0019
EPSS Percentile 9.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
Yealink/SIP-T21P E2 52.84.0.15
Published Dec 08, 2025
Tracked Since Feb 18, 2026