Is there a public PoC exploit available for CVE-2026-12223?

Yes, a public proof-of-concept exploit is available for CVE-2026-12223. Prioritise patching immediately. EPSS: 1.5%.

Yealink SIP-T46U CVE-2026-12223

Q: What is the CVSS score of CVE-2026-12223?

CVE-2026-12223 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.5%.

EUVD-2026-36696 LOW

Command Injection (CWE-77)

2026-06-15 VulDB

GHSA-pcph-rxv7-4pvp

Command Injection Sip T46U Yealink

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Adjacent-network attack requiring low-privilege authentication; no scope change beyond the constrained embedded device; limited C/I/A impact consistent with command injection on a VoIP phone.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 15, 2026 - 06:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jun 15, 2026 - 06:21 vuln.today

DescriptionCVE.org

A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Yealink SIP-T46U IP phone firmware 108.86.0.118 enables authenticated, adjacent-network attackers to execute arbitrary operating system commands by manipulating the ip or port arguments submitted to the /api/inner/tftpuploadiperf Web FastCGI endpoint. Publicly available exploit code exists, and Yealink did not respond to responsible disclosure, meaning no vendor-released patch has been identified at time of analysis. No KEV listing confirms active exploitation, but the combination of a public proof-of-concept, an absent vendor response, and a default-enabled attack surface on widely deployed enterprise VoIP phones elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.

Technical ContextAI

The Yealink SIP-T46U is an enterprise SIP desktop phone whose embedded web management stack includes a FastCGI service (mod_webd) exposing internal diagnostic and administrative APIs. The TFTPUploadIperf function at /api/inner/tftpuploadiperf is designed to initiate TFTP-based file operations combined with iperf network performance testing. CWE-77 (Improper Neutralization of Special Elements Used in a Command) describes the root cause: the user-supplied ip and port parameters are concatenated into a system shell invocation without sanitization, allowing injection of shell metacharacters that are interpreted by the underlying OS. CPE cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting the vulnerability may span multiple firmware releases of the SIP-T46U product line, though only 108.86.0.118 has been explicitly verified by the reporter.

RemediationAI

No vendor-released patch has been identified at time of analysis, as Yealink did not respond to responsible disclosure. Organizations should immediately place SIP-T46U phones on isolated VoIP VLANs with firewall rules restricting access to the phone's Web FastCGI Service (typically TCP 80/443) to designated provisioning and management hosts only - this eliminates adjacency for unauthorized internal attackers while preserving provisioning workflows, though it requires VLAN reconfiguration effort. If iperf diagnostic functionality is not operationally required, block the /api/inner/tftpuploadiperf endpoint at the network perimeter or via an inline application-layer firewall rule; this removes the specific attack surface without broader service disruption. Enforce strong, unique web management credentials on all deployed SIP-T46U units to raise the authentication bar beyond the low-privilege baseline reflected in the CVSS PR:L metric. Monitor internal network traffic for anomalous POST requests targeting VoIP phone management APIs. Reference: https://vuldb.com/vuln/370866.