CVE-2026-12218: Yealink SIP-T46U Stack Buffer Overflow RCE Vulnerability

Technical summary

CVE-2026-12218 is a stack-based buffer overflow (CWE-119, CWE-121) in the Web FastCGI Service of Yealink SIP-T46U 108.87.50.1. The vulnerability exists in the StartReportInformation function within the `/api/inner/beforewifitest` API endpoint. Improper bounds checking on the 'port' parameter allows an authenticated local network attacker to overflow the stack, potentially leading to memory corruption, information disclosure, or code execution. The CVSS 3.1 score of 8.0 (HIGH) reflects the high impact to confidentiality, integrity, and availability, though exploitation requires network adjacency and valid user credentials.

Business impact

A compromised SIP-T46U device could serve as an entry point for lateral movement within an organization's telephony infrastructure. Attackers gaining code execution could eavesdrop on voice calls, intercept credentials, modify call routing, or use the device as a pivot to attack other networked systems. Organizations relying on Yealink phones for secure communications face both immediate confidentiality and integrity risks until patching is deployed.

Affected systems

Yealink SIP-T46U devices running firmware version 108.87.50.1 are confirmed affected. Other versions and related Yealink SIP models may be vulnerable but have not been explicitly confirmed in available advisories. Organizations should audit their current firmware versions and cross-reference against Yealink's official security bulletins to identify all affected models and versions in their environment.

Exploitability

While the vulnerability requires local network access and valid user credentials, the public disclosure and active development status mean proof-of-concept code may be available or become available soon. The relative simplicity of buffer overflow exploitation and the ease of crafting malicious web requests lowers the technical bar for exploitation. Organizations with permissive internal network policies or shared WiFi/LAN environments face elevated risk.

Remediation

Contact Yealink support and monitor their security advisories for official firmware patches. Verify the exact firmware versions deployed across your SIP-T46U fleet immediately. Until patches are available, mitigate by restricting network access to the Web FastCGI Service, limiting local network access to trusted users and devices, and disabling the `/api/inner/beforewifitest` endpoint if not operationally required. Implement network segmentation to isolate telephony devices from general office networks where possible.

Patch guidance

Yealink is developing a patch and has been engaged early in the disclosure process. Check Yealink's official security advisory page and your device management portal for firmware updates. When patches become available, verify the firmware version number against Yealink's release notes before deployment. Test patches in a staging environment with a representative SIP-T46U device to confirm call handling and feature functionality remain intact. Coordinate patching with your phone provisioning system to ensure automated rollout does not disrupt service.

Detection guidance

Monitor for HTTP POST/GET requests to `/api/inner/beforewifitest` with suspicious or oversized 'port' parameter values. Look for unusual process behavior on SIP-T46U devices following API calls (e.g., core dumps, unexpected restarts, or new processes spawning). Correlate device syslog entries with any observed network reconnaissance activity on your telephony segment. Organizations with access to device-level packet capture should inspect for requests containing buffer overflow payloads targeting the StartReportInformation function.

Why prioritize this

This vulnerability merits urgent attention because it combines high CVSS impact (confidentiality, integrity, availability all affected), public exploit availability, active vendor patching, and direct access to voice communications. Although it requires local network access and user authentication, the ubiquity of Yealink SIP phones in enterprise environments and the sensitive nature of telephony data elevate business risk substantially. Exploit availability accelerates the timeline for remediation.

Risk score, explained

The CVSS 3.1 score of 8.0 reflects the high severity: the vulnerability allows remote code execution or denial of service on a sensitive communications device with high confidentiality and integrity impact. The score is tempered by the requirement for adjacent network access (AV:A) and low-privilege user authentication (PR:L), which are typical controls in managed office environments but not absolute barriers in organizations with guest networks or contractor access.

Frequently asked questions