CVE-2020-24113
📋 TL;DR
This vulnerability allows attackers to perform directory traversal attacks through the contacts file upload interface in Yealink W60B devices. Attackers can access sensitive files and cause denial of service. Only Yealink W60B devices running version 77.83.0.85 are affected.
💻 Affected Systems
- Yealink W60B
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, extract credentials, and crash the device causing complete service disruption.
Likely Case
Attackers would access configuration files and cause temporary service interruptions.
If Mitigated
With proper network segmentation and access controls, impact would be limited to isolated network segments.
🎯 Exploit Status
Directory traversal vulnerabilities typically have low exploitation complexity and can be exploited without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than 77.83.0.85
Vendor Advisory: https://www.yealink.com/en/support/security-advisory
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Yealink support portal. 3. Upload firmware to device via web interface. 4. Reboot device after installation.
🔧 Temporary Workarounds
Disable file upload interface
allDisable the contacts file upload functionality if not required
Network segmentation
allIsolate Yealink W60B devices from untrusted networks
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Monitor device logs for directory traversal attempts and file access patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or SSH: show versionCheck Version:
show versionVerify Fix Applied:
Verify firmware version is newer than 77.83.0.85 and test file upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Multiple failed upload attempts
- Directory traversal strings in logs
Network Indicators:
- HTTP requests with ../ patterns in file upload parameters
- Unusual traffic to device management interface
SIEM Query:
source="yealink_logs" AND ("../" OR "..\" OR "%2e%2e%2f")