CVE-2026-12220: Yealink SIP-T46U Stack Buffer Overflow in Firmware Upload

Technical summary

The vulnerability resides in the mod_upgrade.SparePartsUpload function handling the /api/upgrade/accupgradebychunk endpoint. The uid parameter is processed without proper bounds checking, allowing an attacker to trigger a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121: Stack-based Buffer Overflow). Successful exploitation may overwrite the stack, potentially enabling arbitrary code execution or device denial of service. The CVSS 3.1 score of 8.0 (HIGH) reflects high confidentiality, integrity, and availability impact, though the attack vector is limited to adjacent networks and requires authenticated access.

Business impact

Compromised SIP-T46U devices could be leveraged as entry points into internal networks, particularly if firmware is tampered with to establish persistence or act as reconnaissance tools. An attacker gaining code execution could intercept calls, exfiltrate credentials, or pivot to other network resources. Device crashes disrupt communications. In regulated environments (finance, healthcare, government), unauthorized firmware modification may trigger compliance violations. Recovery requires manual intervention and potential reconfiguration of affected phones, creating operational overhead.

Affected systems

Yealink SIP-T46U IP phones running firmware version 108.86.0.118 are confirmed affected. Other firmware versions of the same model may be vulnerable due to similar code paths; verification against the vendor advisory is essential. The SIP-T46U is a mid-to-enterprise-range desk phone commonly deployed in organizations of all sizes. Exposure depends on internal network access and whether attackers possess valid credentials or can bypass authentication controls.

Exploitability

The vulnerability is exploitable but constrained by two factors: (1) attack surface is limited to the local/adjacent network (AV:A in CVSS), and (2) authenticated access is required (PR:L). Public disclosure has occurred, increasing the risk that attack tooling may be developed. However, the local-only nature and authentication requirement make large-scale remote campaigns unlikely. Risk is elevated in environments with weak network segmentation, shared credentials, or untrusted internal users.

Remediation

The vendor (Yealink) has been notified and is working on a patch. Organizations should monitor Yealink's security advisories for firmware updates addressing this issue. Until a patch is available, mitigations include: (1) restricting network access to the firmware upload endpoint via firewall rules; (2) enforcing strong authentication and credential hygiene for administrative users; (3) segmenting voice network infrastructure from untrusted internal subnets; and (4) monitoring device logs for suspicious upgrade attempts. Apply patches promptly once released by the vendor.

Patch guidance

Verify the latest firmware release from Yealink's official support portal or security advisories. Patches are typically delivered as firmware updates applied through the device's web interface or centralized provisioning system. Test patches in a non-production environment before broad deployment. Document the pre-patch firmware version and establish a rollback procedure if needed. Coordinate firmware updates with your voice infrastructure team to avoid service disruption, as devices typically require a restart to apply updates.

Detection guidance

Monitor logs and network traffic for suspicious access to the /api/upgrade/accupgradebychunk endpoint, particularly requests with unusual uid parameter values or from unexpected source IPs. Look for authentication failures followed by successful login on phone admin interfaces. Inspect device syslog entries for unexpected firmware update activities or crashes. Network-based detection can flag abnormal binary data in upgrade payloads. Endpoint detection and response (EDR) tools on adjacent computers may detect process anomalies if code execution occurs, though phones themselves typically have limited logging. Regular device inventory scans can confirm firmware versions.

Why prioritize this

Although the attack vector is restricted to local networks and requires authentication, the potential for code execution combined with public disclosure justifies HIGH priority. IP phones are often overlooked in security posture assessments and may reside in network zones with lower security controls than servers or workstations. Firmware-level compromise is difficult to detect and remediate. Organizations with large phone deployments, open internal networks, or shared administrative credentials should treat this as urgent. Smaller organizations with tight physical and logical access controls may deprioritize slightly but should not defer indefinitely.

Risk score, explained

CVSS 3.1 score of 8.0 (HIGH) reflects the severity of potential impacts: unauthorized code execution, data interception, and service disruption. The score is moderated from critical by the Adjacent Network attack vector and requirement for Low privileges (authenticated user). The User Interaction requirement is None, meaning no user interaction is needed after authentication. Scope is Unchanged (contained to the affected phone), but all three impact categories (confidentiality, integrity, availability) are rated High, indicating broad consequences if successfully exploited.

Frequently asked questions