The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.
CWE-79