CVE-2021-27561

Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability

Device Management

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

15. Okt 2021

Ausgewertete Quellen

• Hinweis
  https://ssd-disclosure.com/?p=4688
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27561
• CISA
  Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability
• NVD
  CVE-2021-27561