EUVD-2026-36694
GHSA-3x75-g3h6-5r8m
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network upload endpoint (AV:A), straightforward overflow (AC:L), requires low-privilege phone account (PR:L), no user interaction, full compromise of the phone firmware yields high C/I/A with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers with low privileges to corrupt memory via crafted uid or start_offset parameters sent to the /api/upgrade/upgrade firmware chunk upload endpoint. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving deployed devices without an official patch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must reach the phone over the adjacent/local network (AV:A) and possess low-privilege credentials to the phone's web management interface (PR:L), and must be able to send POST requests to the /api/upgrade/upgrade Firmware Chunk Upload Handler with manipulated uid or start_offset parameters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N) places the attack on the adjacent network with low complexity and low privileges, which matches the description's statement that the attack must be approached from the local network and presumably requires a low-privilege account on the phone's web interface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained any foothold on the same LAN as the phone - for example a phished workstation or a guest-network bridge - authenticates to the phone's web API with a low-privilege account (or default/weak credentials), then sends a crafted POST to /api/upgrade/upgrade with an oversized uid or start_offset parameter that overflows the stack buffer reached via sprintf. Because publicly available exploit code exists, the attacker can reuse the published proof-of-concept to achieve code execution on the phone, potentially turning it into a covert audio-monitoring device or a pivot into the VoIP segment. |
| Remediation | No vendor-released patch identified at time of analysis, as Yealink did not respond to disclosure outreach - affected operators should monitor https://support.yealink.com for a future firmware release above 108.86.0.118 and apply it as soon as published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Yealink SIP-T46U devices running firmware 108.86.0.118 via inventory systems and network scans; implement network segmentation to isolate phones to separate VLANs if feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.87.50.1) allows adjacent-network attackers wi
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers w
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows authenticated adjacent-netwo
Command injection in Yealink SIP-T46U firmware 108.86.0.118 enables remote authenticated attackers to execute arbitrary
Command injection in the Yealink SIP-T46U IP phone firmware 108.86.0.118 enables authenticated, adjacent-network attacke
Share
External POC / Exploit Code
Leaving vuln.today