CVE-2014-3427: CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inje...

Security readout for executives and security teams

CVE-2014-3427 is a CRLF injection issue in Yealink VoIP phones running firmware 28.72.0.2. A remote attacker could manipulate a servlet parameter to inject HTTP headers and potentially split responses. The supplied sources do not provide CVSS, affected model list, patch status, or evidence of active exploitation. Exposure is most likely where Yealink phone web interfaces on firmware 28.72.0.2 are reachable by untrusted users or networks. Exact affected models are not provided in the supplied record. Treat as moderate priority unless affected Yealink web interfaces are exposed to untrusted networks. Business urgency depends on inventory and management-plane exposure. Mitigation focus: Inventory Yealink VoIP phones and identify firmware 28.72.0.2.; Check Yealink guidance for fixed firmware or vendor-recommended remediation.; Restrict phone web interfaces to trusted administration networks only..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.