Which versions of Yealink SIP-T46U are affected by CVE-2026-12222?

Yealink SIP-T46U IP phones running firmware 108.86.0.118 contain a memory corruption vulnerability with publicly available exploit code and no vendor patch currently available.

Is there a public PoC exploit available for CVE-2026-12222?

Yes, a public proof-of-concept exploit is available for CVE-2026-12222. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-12222?

24 hours: Identify all Yealink SIP-T46U devices running firmware 108.86.0.118; implement network segmentation to restrict LAN access to phones from trusted networks only. 7 days: Complete risk assessment; enable network monitoring for suspicious access attempts to phone web interfaces and BlueToothTest endpoints; disable Bluetooth and web administration if operationally feasible. 30 days: Develop long-term remediation strategy including device replacement or firmware alternatives; maintain network controls until vendor releases patched firmware.

Yealink SIP-T46U CVE-2026-12222

Q: What is the CVSS score of CVE-2026-12222?

CVE-2026-12222 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36695 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-15 VulDB

GHSA-3c47-ghg7-jxpp

Buffer Overflow Stack Overflow Sip T46U Yealink

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent-network FastCGI endpoint requires LAN access (AV:A) and low-privilege web auth (PR:L); overflow yields full code execution on the phone, so C/I/A all High with unchanged scope.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 15, 2026 - 06:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 15, 2026 - 06:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 15, 2026 - 06:22 vuln.today

cvss_changed

CVSS changed

Jun 15, 2026 - 06:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Jun 15, 2026 - 06:20 vuln.today

DescriptionCVE.org

A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows authenticated adjacent-network attackers to corrupt memory via the BlueToothTest handler exposed by the Web FastCGI service. Supplying crafted btMac, pin, or reserved parameters to /api/inner/bttest triggers the overflow inside mod_webd.BlueToothTest, with publicly available exploit code exists demonstrating an off-by-one write. The flaw is reachable from the LAN rather than the public internet, but the vendor has not responded to disclosure and no patched firmware has been published.

Technical ContextAI

The Yealink SIP-T46U is an enterprise VoIP desk phone whose web management interface is implemented as FastCGI modules behind an embedded HTTP server. The affected handler, mod_webd.BlueToothTest, services the internal endpoint /api/inner/bttest used to drive Bluetooth pairing self-tests, and copies the btMac, pin, and reserved POST parameters into fixed-size stack buffers without sufficient length validation. This is a classic CWE-121 stack-based buffer overflow; the publicly released proof of concept characterizes it specifically as an off-by-one, which on ARM/MIPS embedded targets like this phone can corrupt the saved frame pointer or stack canary slot and pivot control flow from within the long-running webd process.

RemediationAI

No vendor-released patch identified at time of analysis - Yealink was contacted but did not respond, so administrators cannot currently upgrade to a fixed firmware. Until Yealink publishes a corrected build, compensating controls should restrict reachability of the management plane: place SIP-T46U phones on a dedicated voice VLAN with ACLs that permit only the call manager and provisioning server to reach TCP 80/443 (this preserves SIP/RTP signalling but blocks LAN attackers from the web service), and disable any 'inner' or developer/test endpoints exposed through the phone's local web admin if the menu allows it (note this will break the in-phone Bluetooth self-test workflow). Rotate the local web/admin credentials to non-default values to make the PR:L precondition harder to satisfy, monitor egress from the voice VLAN for anomalous outbound connections that would signal post-exploit C2, and track https://vuldb.com/vuln/370865 and Yealink security bulletins for a firmware update past 108.86.0.118.