CVE-2023-43959 is a high-severity OS command-injection vulnerability (CWE-78) in the Yealink SIP-T19P-E2 IP desk phone: an attacker who is already logged into the phone's web management interface can submit a crafted request to the built-in network-diagnostics ping/traceroute function and have arbitrary operating-system commands executed with root privileges, even though the attacker only needs low (non-administrative) privileges to trigger it; NVD has published its own Primary CVSS v3.1 score of 8.8 (high) for the flaw.
Vulnerability summary
8.8
High
2.0%
EPSS score (FIRST)
No
CISA KEV catalog
2023-10-17
Published
Vulnerability ID: CVE-2023-43959 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Yealink SIP-T19P-E2 IP desk phone | — | Firmware version 53.84.0.15, per NVD's description. No Yealink vendor security bulletin or fixed firmware version for this CVE was found as of this writing; the issue was disclosed by independent researchers rather than acknowledged in Yealink's own published security-bulletin list. |
What does this mean for affected devices?
CVE-2023-43959 (NVD Primary weakness CWE-78, OS command injection) affects the Yealink SIP-T19P-E2 IP desk phone. NVD's description states: "An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component" (NVD).
An independent technical write-up of the flaw explains the exploitation mechanism in more detail: the phone's web interface exposes a Network Diagnostics feature that is meant to run ping or traceroute, reachable via a POST request to /servlet?m=mod_data&p=network-diagnosis&q=docmd; the request's cmd parameter is passed to the underlying system command without adequate sanitization, so a value such as ; id; appended after the intended ping target causes the device to execute the injected command as root once the attacker supplies a valid session token for an already-authenticated session (HackMD: Yealink IP Phone Authenticated RCE write-up).
This requirement for an authenticated session is reflected in NVD's own CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with privileges required (PR) set to Low — a legitimate but low-privileged logged-in user, not an anonymous visitor, can trigger the command execution and then run as root (NVD). NVD's own Primary CVSS v3.1 base score for this vector is 8.8 (high) (NVD).
A public exploit-db entry documents the same request/response flow as a working proof of concept against the affected firmware (Exploit-DB #50509).
No entry for this CVE or the SIP-T19P-E2 model's ping/diagnostic command injection currently appears on Yealink's published security-bulletin page, and no vendor-confirmed fixed firmware version has been located; phone operators should treat this as unresolved from the vendor's side and should contact Yealink support directly for the current remediation status of this model and firmware branch rather than assume a patch already exists (Yealink Security Bulletins).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0197 (80.533rd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
Any deployment of the Yealink SIP-T19P-E2 running firmware 53.84.0.15 should restrict who can log into the phone's web interface, since any authenticated session — even a low-privileged one — can be used to reach root-level command execution through the diagnostics page.
Evidence
- An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request to the ping function of the diagnostic component (CWE-78). — NVD
- The Network Diagnostics feature is reachable via POST to /servlet?m=mod_data&p=network-diagnosis&q=docmd; its cmd parameter is passed to a system command without adequate sanitization, so injected shell metacharacters (e.g. '; id;') execute as root given a valid session token. — HackMD: Yealink IP Phone Authenticated RCE write-up
- NVD Primary CVSS v3.1 base score 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (privileges required: Low, i.e. an authenticated low-privileged session suffices). — NVD
- A public proof-of-concept exploit for this request/response flow is documented against the affected firmware. — Exploit-DB #50509
- No entry for this CVE or the SIP-T19P-E2 ping/diagnostic command injection appears on Yealink's published security-bulletin page as of this writing. — Yealink Security Bulletins
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0197 (80.533rd percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
Does an attacker need to be logged in to exploit CVE-2023-43959?
Yes. NVD's CVSS vector marks privileges required as Low, meaning an attacker needs a valid, even low-privileged, authenticated session on the phone's web interface before they can inject commands through the ping diagnostic function (per NVD; per the HackMD technical write-up).
What happens if the vulnerability is exploited?
The injected operating-system command runs with root privileges on the Yealink SIP-T19P-E2 phone, giving the attacker full control of the device rather than just the limited diagnostic output the feature was meant to return (per NVD; per the HackMD technical write-up).
Has Yealink published a fix for this issue?
No fixed firmware version or vendor security bulletin covering this CVE or the SIP-T19P-E2 ping/diagnostic command injection has been found on Yealink's published security-bulletin page as of this writing; affected deployments should contact Yealink support for current status and restrict access to the phone's web interface in the meantime (per Yealink Security Bulletins).