CVE-2024-28442 Overview
CVE-2024-28442 is a directory traversal vulnerability affecting the Yealink VP59 IP phone running firmware version 91.15.0.118. The flaw resides in the terms of use function within the company portal component. An attacker can abuse the WebView component to escape the intended file scope and access sensitive files on the device. The issue is classified under [CWE-200] Information Exposure and impacts the confidentiality of data stored on the phone.
Critical Impact
Successful exploitation enables unauthorized disclosure of sensitive files from the Yealink VP59 device through a WebView escape in the company portal.
Affected Products
- Yealink VP59 hardware (IP phone)
- Yealink VP59 firmware version 91.15.0.118
- Company portal component (terms of use function)
Discovery Timeline
- 2024-03-26 - CVE-2024-28442 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28442
Vulnerability Analysis
The Yealink VP59 exposes a company portal component that renders content inside a WebView. The terms of use function loads local resources without enforcing strict path validation. By supplying crafted relative path sequences, an attacker can traverse outside the intended directory and read arbitrary files accessible to the WebView process.
The consequence is sensitive file disclosure on the device. According to the public Medium analysis, the WebView escape allows attackers to retrieve configuration data and other local files that should remain isolated from the portal context. Integrity and availability are not directly impacted, but disclosed credentials or configuration material can enable follow-on attacks against the wider VoIP environment.
Root Cause
The root cause is improper input validation on file path parameters processed by the company portal's terms of use handler. The handler resolves user-influenced paths against the local file system without canonicalization or allowlisting. This permits ../ style sequences to escape the intended document root.
Attack Vector
The NVD record describes a physically proximate attacker interacting with the company portal. The attacker triggers the terms of use function and supplies a path traversal payload through the WebView interface. No authentication is required to reach the affected component, and exploitation does not require user interaction beyond the attacker's own access to the portal feature. Refer to the Medium analysis on CVE-2024-28442 for the documented WebView escape technique.
No verified exploit code is published by the vendor or NVD.
See the linked Medium analysis for a technical walkthrough of the WebView escape.
Detection Methods for CVE-2024-28442
Indicators of Compromise
- Requests to the company portal terms of use endpoint containing ../, ..%2f, or encoded traversal sequences.
- WebView access logs referencing files outside the expected portal asset directory.
- Unexpected reads of configuration files, credential stores, or system paths on the VP59 device.
Detection Strategies
- Inspect VP59 application logs for path traversal patterns submitted to the company portal component.
- Monitor network captures between the phone and management infrastructure for anomalous file retrieval responses.
- Review physical access logs for conference rooms or shared spaces where Yealink VP59 phones are deployed.
Monitoring Recommendations
- Forward Yealink VP59 syslog output to a centralized SIEM and alert on traversal-style strings against the portal URL paths.
- Track baseline behavior for the company portal feature and flag deviations such as repeated terms of use invocations.
- Correlate VoIP device activity with identity and network telemetry to identify pivoting attempts following file disclosure.
How to Mitigate CVE-2024-28442
Immediate Actions Required
- Inventory all Yealink VP59 devices and identify any running firmware 91.15.0.118 or earlier.
- Restrict physical access to deployed VP59 handsets, particularly in lobbies, conference rooms, and shared workspaces.
- Disable or restrict the company portal feature where it is not required for business operations.
Patch Information
No vendor advisory URL is published in the NVD record at the time of writing. Administrators should consult the Yealink VP59 product page and contact Yealink support for firmware updates that supersede version 91.15.0.118. Apply firmware updates through the standard Yealink Device Management Platform once a fixed build is provided.
Workarounds
- Segment VoIP devices onto a dedicated VLAN and limit management plane exposure to trusted hosts.
- Remove or disable the terms of use function in the company portal configuration if administrative controls permit.
- Rotate any credentials or configuration secrets that may have been stored on potentially exposed VP59 devices.
# Example: restrict access to VP59 management interfaces via firewall ACL
iptables -A INPUT -s <trusted_mgmt_subnet> -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
