EUVD-2026-36695
GHSA-3c47-ghg7-jxpp
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network FastCGI endpoint requires LAN access (AV:A) and low-privilege web auth (PR:L); overflow yields full code execution on the phone, so C/I/A all High with unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows authenticated adjacent-network attackers to corrupt memory via the BlueToothTest handler exposed by the Web FastCGI service. Supplying crafted btMac, pin, or reserved parameters to /api/inner/bttest triggers the overflow inside mod_webd.BlueToothTest, with publicly available exploit code exists demonstrating an off-by-one write. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must reside on the same broadcast domain or routed-adjacent network as a Yealink SIP-T46U phone running firmware 108.86.0.118 (AV:A - not internet-reachable by default) and must hold valid low-privilege credentials to the phone's web management interface to invoke the /api/inner/bttest FastCGI endpoint (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.3) accurately reflects a high-impact but adjacency-limited bug: an attacker must already sit on the same LAN/VLAN as the phone and hold low-level credentials to reach the inner FastCGI endpoint, but once those gates are passed the overflow yields full confidentiality, integrity and availability loss on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a foothold on the corporate LAN - for example through a compromised workstation or rogue Wi-Fi client on the voice VLAN - authenticates to a SIP-T46U with weak or default user credentials and POSTs an oversized btMac/pin/reserved payload to /api/inner/bttest. The published proof-of-concept archive (T46U_mod_webd_BlueToothTest_off_by_one.zip) overflows the stack inside the webd FastCGI worker, giving the attacker code execution on the phone, which can then be used to wiretap calls, pivot deeper into the voice VLAN, or serve as a quiet persistence point on the internal network. |
| Remediation | No vendor-released patch identified at time of analysis - Yealink was contacted but did not respond, so administrators cannot currently upgrade to a fixed firmware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all Yealink SIP-T46U devices running firmware 108.86.0.118; implement network segmentation to restrict LAN access to phones from trusted networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.87.50.1) allows adjacent-network attackers wi
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers w
Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers w
Command injection in Yealink SIP-T46U firmware 108.86.0.118 enables remote authenticated attackers to execute arbitrary
Command injection in the Yealink SIP-T46U IP phone firmware 108.86.0.118 enables authenticated, adjacent-network attacke
Share
External POC / Exploit Code
Leaving vuln.today