Which versions of Yealink SIP-T46U are affected by CVE-2026-12218?

A memory corruption vulnerability in Yealink SIP-T46U IP phones (firmware 108.87.50.1) exposes organizations to unauthorized access and potential service degradation with no available security patch.

Is there a public PoC exploit available for CVE-2026-12218?

Yes, a public proof-of-concept exploit is available for CVE-2026-12218. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-12218?

Within 24 hours: Conduct comprehensive inventory scan to identify all Yealink SIP-T46U phones with firmware 108.87.50.1; isolate these devices from external network access using network segmentation. Within 7 days: Implement firewall rules to block all inbound traffic to the Web FastCGI service (port 8025) on affected devices and restrict administrative access to management VPN only. Within 30 days: Execute replacement or firmware upgrade strategy-verify whether Yealink has released patched firmware versions beyond 108.87.50.1 and begin phased migration of affected inventory.

Yealink SIP-T46U CVE-2026-12218

Q: What is the CVSS score of CVE-2026-12218?

CVE-2026-12218 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36691 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-15 VulDB

GHSA-4hcr-4qf7-mjh5

Buffer Overflow Stack Overflow Sip T46U Yealink

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent-network FastCGI endpoint (AV:A), low complexity reliable overflow (AC:L), requires authenticated low-priv web user (PR:L), no user interaction, and full code-execution impact on the phone (C/I/A:H).

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 06:23 vuln.today

CVSS changed

Jun 15, 2026 - 06:22 NVD

8.6 (HIGH) 7.3 (HIGH)

CVSS changed

Jun 15, 2026 - 06:22 NVD

8.6 (HIGH) 7.3 (HIGH)

DescriptionCVE.org

A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.87.50.1) allows adjacent-network attackers with low-privileged access to corrupt memory via the port argument processed by the StartReportInformation function in the /api/inner/beforewifitest endpoint of the Web FastCGI Service. Publicly available exploit code exists, and the vendor was notified without response, leaving deployed devices unmitigated. No public exploit identified as active in-the-wild campaigns, but exploitation is feasible given the released PoC.

Technical ContextAI

The Yealink SIP-T46U is an enterprise VoIP desk phone that exposes a web-based management interface backed by a FastCGI service. The vulnerable handler StartReportInformation, reachable through the inner API path /api/inner/beforewifitest, copies a user-supplied 'port' argument into a fixed-size stack buffer without sufficient length validation, matching the CWE-121 (Stack-based Buffer Overflow) classification. Because FastCGI handlers typically run with elevated rights on embedded Linux firmware, overflowing this buffer can corrupt the saved return address or adjacent stack data, enabling control-flow hijack on the device's ARM/MIPS-class processor. The affected CPE cpe:2.3:a:yealink:sip-t46u confirms the SIP-T46U product line is impacted at firmware 108.87.50.1.

RemediationAI

No vendor-released patch identified at time of analysis - Yealink did not respond to the coordinated disclosure attempt reported by VulDB (https://vuldb.com/vuln/370861). Until a firmware update is published, place SIP-T46U phones on a dedicated voice VLAN that is firewalled from general user and guest networks so the adjacent-network attack vector cannot be reached by ordinary endpoints, accepting the trade-off of additional switching/routing configuration. Restrict access to the phone's web management interface to a dedicated administration subnet or jump host, rotate and harden the low-privilege web credentials that satisfy the PR:L requirement, and consider disabling the web UI on phones that are centrally provisioned via auto-provisioning servers since this removes the FastCGI attack surface but also removes per-device administrative control. Monitor https://www.yealink.com/en/onepage/trust-center-security-advisories for an eventual advisory and apply the fixed firmware once available.