CVE-2026-12219: Yealink SIP-T46U Command Injection in Firmware 108.86.0.118

Technical summary

The vulnerability exists in the mod_diagnose.CommandShellByType function within the Web FastCGI Service component, specifically in the /api/diagnosis/start endpoint. The flaw arises from insufficient input validation on the Time argument, allowing command injection attacks. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-77 (Improper Neutralization of Special Elements used in a Command). Exploitation requires valid credentials (CVSS reflects PR:L—Low privilege requirement), and no user interaction is needed once authenticated. Network accessibility and lack of complexity protections make this a straightforward attack vector.

Business impact

Compromised Yealink phones can be leveraged as beachheads into corporate voice infrastructure and the broader network. An attacker with valid credentials (a compromised user account, vendor support access, or default credentials if not changed) gains the ability to execute commands with the privileges of the Web FastCGI Service process. This could lead to unauthorized access to call logs, configuration data, or lateral movement to connected systems. For organizations relying on Yealink devices for unified communications, this represents a post-authentication privilege escalation risk that could disrupt or compromise voice operations.

Affected systems

Yealink SIP-T46U IP phones running firmware version 108.86.0.118 are confirmed vulnerable. Organizations should inventory their Yealink device fleet and check current firmware versions. The SIP-T46U is a mid-to-enterprise-range handset commonly deployed in larger organizations; scope and impact depend on deployment breadth and credential hygiene in your environment.

Exploitability

The vulnerability requires valid authentication to the device's web interface—an attacker cannot exploit it anonymously. However, the CVSS score of 6.3 (Medium) reflects the practical reality that compromised credentials, default accounts, or insider threats can make this exploitable in real-world scenarios. The fact that exploit details have been published increases the likelihood of opportunistic or targeted attacks against known vulnerable instances. The attack requires no special techniques or complex setup once authentication is obtained.

Remediation

Upgrade affected Yealink SIP-T46U devices to firmware version 108.87.0.23 or later. Before patching, enforce strong, unique passwords on all Yealink device web interfaces and disable remote management if not operationally necessary. Restrict network access to the /api/diagnosis/start endpoint using firewall rules or IP allowlisting. Monitor authentication logs for suspicious login attempts on these devices.

Patch guidance

Yealink provides firmware updates via their vendor portal or through push mechanisms if auto-update is enabled. Verify the exact firmware version on affected devices by accessing the device web interface (typically http://<device-ip>) and navigating to Settings > Firmware. Download firmware 108.87.0.23 from Yealink's support site and follow their standard firmware upgrade procedures. Test the update in a non-critical device or lab environment first. After upgrade, verify devices have rebooted and are operating normally before rolling out to production.

Detection guidance

Monitor for POST requests to /api/diagnosis/start endpoints on your Yealink devices. Look for unusual or repeated authentication failures on device web interfaces, particularly if they precede successful logins. Check Web FastCGI Service logs (if accessible) for errors or command execution patterns. Use network segmentation to isolate phone system traffic and apply IDS/IPS rules to alert on suspicious parameter values in /api/diagnosis/ requests. Track firmware versions across your fleet using device management tools or periodic audits.

Why prioritize this

This vulnerability merits prompt but measured attention. It requires authentication, lowering immediate risk for properly secured deployments. However, the combination of public exploit availability, remote exploitability, and potential for lateral movement into voice and network infrastructure justifies prioritization above routine patches. Organizations with weak phone system password policies or those who have not changed vendor default credentials should treat this as higher priority.

Risk score, explained

The CVSS 3.1 score of 6.3 (Medium) reflects a remote network attack (AV:N) with low complexity (AC:L), low privilege requirement (PR:L), and no user interaction needed (UI:N). The impact is limited to the affected system (S:U) but includes confidentiality, integrity, and availability concerns (C:L/I:L/A:L). The score does not account for the published exploit status or organizational context; your internal risk may be higher or lower depending on credential management, network segmentation, and device exposure.

Frequently asked questions