8
CVEs
0
Critical
5
High
0
KEV
8
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
5
MEDIUM
1
LOW
2
Monthly CVE Trend
Affected Products (26)
Sip T46U
6
Sip T38G
4
Yealink Meeting Server
3
Vp59 Firmware
3
Voip Phone Firmware
2
Sip T21 P E2 Firmware
2
Ultra Elegant Ip Phone Sip T46G
1
Device Management
1
Ultra Elegant Ip Phone Sip T41P
1
Ultra Elegant Ip Phone Sip T48G
1
Gigabit Color Ip Phone Sip T38G
1
Ip Phone Sip T21P
1
Gigabit Color Ip Phone Sip T32G
1
Ip Phone Sip T20P
1
Sip T19P E2 Firmware
1
W52P
1
Ultra Elegant Ip Phone Sip T42G
1
Ip Phone Sip T26P
1
Ip Phone Sip T22P
1
Ip Video Phone Vp530
1
Ip Phone Sip T19P
1
Sip T28P Firmware
1
Configuration Encryption Tool
1
Voip Phone
1
Ip Phone Sip T28P
1
Tiptel Ip 286 Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-66738 | Authenticated command injection in the Yealink SIP-T21P_E2 IP phone (firmware 52.84.0.15) lets a remote user with normal, non-administrative privileges execute arbitrary operating-system commands by sending a crafted request to the ping utility of the diagnostic component. Because the CVSS vector reports PR:L, exploitation requires only a low-privileged authenticated session, and publicly available exploit code exists, though the EPSS probability remains modest at 0.60% (44th percentile) and the flaw is not listed in CISA KEV. Successful exploitation yields full high-impact compromise of confidentiality, integrity, and availability on the device. | HIGH | 8.8 | 0.6% | 65 |
PoC
No patch
|
| CVE-2026-12218 | Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.87.50.1) allows adjacent-network attackers with low-privileged access to corrupt memory via the port argument processed by the StartReportInformation function in the /api/inner/beforewifitest endpoint of the Web FastCGI Service. Publicly available exploit code exists, and the vendor was notified without response, leaving deployed devices unmitigated. No public exploit identified as active in-the-wild campaigns, but exploitation is feasible given the released PoC. | HIGH | 7.3 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-12220 | Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers with low-privilege credentials to corrupt memory via the uid parameter of the /api/upgrade/accupgradebychunk firmware chunk upload endpoint. Publicly available exploit code exists and the vendor did not respond to coordinated disclosure, raising the practical risk despite the adjacent-only attack vector. No public exploit identified as actively exploited in the wild (not on CISA KEV). | HIGH | 7.3 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-12221 | Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers with low privileges to corrupt memory via crafted uid or start_offset parameters sent to the /api/upgrade/upgrade firmware chunk upload endpoint. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving deployed devices without an official patch. CVSS 4.0 rates this 8.6 (High) with proof-of-concept maturity (E:P). | HIGH | 7.3 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-12222 | Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows authenticated adjacent-network attackers to corrupt memory via the BlueToothTest handler exposed by the Web FastCGI service. Supplying crafted btMac, pin, or reserved parameters to /api/inner/bttest triggers the overflow inside mod_webd.BlueToothTest, with publicly available exploit code exists demonstrating an off-by-one write. The flaw is reachable from the LAN rather than the public internet, but the vendor has not responded to disclosure and no patched firmware has been published. | HIGH | 7.3 | 0.4% | 57 |
PoC
No patch
|
| CVE-2025-66737 | Directory traversal in Yealink SIP-T21P(E2) IP phone firmware 52.84.0.15 exposes arbitrary files to low-privileged remote attackers via a crafted request to the diagnostic component's result read function. The flaw is confined to confidentiality impact - attackers can exfiltrate sensitive files (credentials, configuration, logs) stored on the device but cannot modify or crash it. A publicly available proof-of-concept exists, though EPSS at 0.62% indicates limited observed exploitation activity and the device is not listed in the CISA KEV catalog. | MEDIUM | 4.3 | 0.6% | 42 |
PoC
No patch
|
| CVE-2026-12219 | Command injection in Yealink SIP-T46U firmware 108.86.0.118 enables remote authenticated attackers to execute arbitrary OS commands via the unsanitized `Time` argument passed to the `mod_diagnose.CommandShellByType` function at the `/api/diagnosis/start` diagnostic endpoint. The exploit leverages the Web FastCGI Service's failure to neutralize shell metacharacters before invoking underlying system commands, consistent with CWE-77. A public proof-of-concept exploit archive is confirmed available, no CISA KEV listing exists at time of analysis, and the vendor did not respond to disclosure - leaving the vulnerability unpatched. | LOW | 2.1 | 1.5% | 32 |
PoC
No patch
|
| CVE-2026-12223 | Command injection in the Yealink SIP-T46U IP phone firmware 108.86.0.118 enables authenticated, adjacent-network attackers to execute arbitrary operating system commands by manipulating the `ip` or `port` arguments submitted to the `/api/inner/tftpuploadiperf` Web FastCGI endpoint. Publicly available exploit code exists, and Yealink did not respond to responsible disclosure, meaning no vendor-released patch has been identified at time of analysis. No KEV listing confirms active exploitation, but the combination of a public proof-of-concept, an absent vendor response, and a default-enabled attack surface on widely deployed enterprise VoIP phones elevates practical risk beyond the moderate CVSS 4.0 score of 5.1. | LOW | 2.0 | 1.5% | 32 |
PoC
No patch
|