EUVD-2026-36693
GHSA-xgmc-rwmg-ch77
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent LAN access required (AV:A), low complexity, requires low-privilege web credentials on the phone (PR:L), no user interaction, and stack overflow in firmware-upgrade handler yields full C/I/A impact on the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers with low-privilege credentials to corrupt memory via the uid parameter of the /api/upgrade/accupgradebychunk firmware chunk upload endpoint. Publicly available exploit code exists and the vendor did not respond to coordinated disclosure, raising the practical risk despite the adjacent-only attack vector. No public exploit identified as actively exploited in the wild (not on CISA KEV).
Technical ContextAI
The flaw resides in the mod_upgrade.SparePartsUpload handler implementing chunked firmware uploads on Yealink T46U enterprise SIP phones, a class of embedded VoIP endpoints commonly deployed across office LANs. The root cause is CWE-121 (stack-based buffer overflow): the uid argument supplied to the /api/upgrade/accupgradebychunk REST endpoint is copied into a fixed-size stack buffer without proper bounds checking, enabling overwrite of the saved return address or adjacent stack variables. Per the CPE (cpe:2.3:a:yealink:sip-t46u:*), the affected component is the firmware-upgrade web service that exposes administrative HTTP APIs on the phone's management interface.
RemediationAI
No vendor-released patch identified at time of analysis - Yealink did not respond to the reporter's disclosure attempts. As compensating controls, restrict network access to the phone's HTTP management interface using L2/L3 ACLs so that only the provisioning server and trusted administrative hosts can reach /api/upgrade/* endpoints; this is the most direct mitigation and has minimal side effects on phone-user functionality. Place SIP phones on a dedicated VLAN isolated from general user workstations to reduce the pool of potential adjacent attackers, accepting added switch-configuration overhead. Disable or change default administrative credentials and monitor authentication logs on the phones, since exploitation requires PR:L (some authentication). Track https://vuldb.com/cve/CVE-2026-12220 and https://vuldb.com/vuln/370863 for any future Yealink firmware update beyond 108.86.0.118.
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows authenticated adjacent-netwo
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers w
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.87.50.1) allows adjacent-network attackers wi
Command injection in Yealink SIP-T46U firmware 108.86.0.118 enables remote authenticated attackers to execute arbitrary
Command injection in the Yealink SIP-T46U IP phone firmware 108.86.0.118 enables authenticated, adjacent-network attacke
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today