Yealink SIP-T46U CVE-2026-12219

No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure, and no patched firmware version is confirmed from available data. As a primary compensating control, restrict network access to the phone's web management interface (typically TCP ports 80 and 443) to trusted management VLANs only, using firewall ACLs or network segmentation - this directly blocks the AV:N attack vector without requiring device changes. If web management is not operationally required, disable it via the phone's local menu if accessible. Change all default credentials on the device to enforce the PR:L authentication barrier against unauthorized low-privilege access; note that this mitigates but does not eliminate risk from legitimately authenticated users. Monitor for anomalous HTTP POST requests to /api/diagnosis/start in network traffic logs or proxy logs. Organizations should contact Yealink support directly for patch status and check for updated firmware at the vendor's support portal. The VulDB submission tracking this issue is at https://vuldb.com/cve/CVE-2026-12219.