CVE-2026-12222: Yealink SIP-T46U Stack Buffer Overflow in Web FastCGI Bluetooth Service

Technical summary

CVE-2026-12222 is a CWE-119/CWE-121 stack-based buffer overflow in the mod_webd.BlueToothTest function within Yealink's Web FastCGI Service. The vulnerability stems from insufficient bounds checking on the btMac, pin, and reserved parameters passed to /api/inner/bttest. When malformed input is supplied, it overwrites stack memory, potentially enabling code execution. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires local network access and low privilege, but delivers high impact across confidentiality, integrity, and availability.

Business impact

Compromise of Yealink SIP-T46U phones could expose call recordings, intercept VoIP communications, or use the device as a pivot point into corporate networks. Affected organizations may face service disruption if phones crash or are remotely disabled. For enterprises relying on these endpoints for critical communications, widespread deployment of vulnerable firmware creates both immediate availability and data protection risks. Remediation requires coordinated patching across potentially hundreds of devices.

Affected systems

Yealink SIP-T46U IP phones running firmware 108.86.0.118 are confirmed vulnerable. The vulnerability is specific to the Web FastCGI Service and its Bluetooth testing function, so exposure is limited to devices with this firmware revision and network access to the affected endpoint. Environments where phones are segregated on restricted VLANs with limited user access face lower immediate risk than open network deployments.

Exploitability

The vulnerability is exploitable by authenticated users on the local network—no remote exploitation is possible without network access to the phone. Public disclosure of exploit details increases the likelihood of weaponization by malicious insiders or attackers who have already gained network proximity. The low complexity of exploitation and lack of user interaction required (UI:N) make this a practical attack vector once an attacker has local access.

Remediation

Yealink is actively developing a patch; organizations should monitor Yealink's security advisories for a fixed firmware version and test it in a controlled environment before broad deployment. As an interim measure, restrict network access to affected phones via firewall rules, disable Bluetooth functionality if not required, and enforce strong authentication for phone management interfaces. Isolate phones on a dedicated VLAN with minimal lateral movement opportunities.

Patch guidance

Verify the availability of patched firmware from Yealink's official security advisory or support portal. Once released, firmware updates should be applied through Yealink's device management tools or web interface after validation in a lab environment. Ensure phones are accessible for updates and plan for brief service interruption during the update process. Document the pre-patch and post-patch firmware versions for compliance auditing.

Detection guidance

Monitor for HTTP POST requests to /api/inner/bttest endpoints on affected phones, particularly those with unusual or oversized parameter values in btMac, pin, or reserved fields. Check firewall and intrusion detection systems for traffic patterns consistent with buffer overflow attempts. Review phone logs and Web FastCGI Service logs for crashes or unusual errors coinciding with suspicious web requests. Network segmentation monitoring can alert on unexpected communication from phones to sensitive systems.

Why prioritize this

Despite requiring local network access, this vulnerability merits rapid attention because public exploits are available, affected phones typically have persistent network presence and elevated trust within corporate networks, and exploitation can lead to full system compromise. The HIGH CVSS score reflects the severity of potential impact (code execution) even though the attack surface is limited to authenticated local users. Organizations should prioritize patching over less imminent threats.

Risk score, explained

The CVSS 3.1 score of 8 (HIGH) is driven by the combination of high impact (C:H/I:H/A:H) and the low barrier to exploitation (AC:L/UI:N). The local network requirement (AV:A) and need for user privileges (PR:L) prevent a critical rating, but the presence of public exploit code and the phone's role as a trusted network endpoint elevate practical risk significantly above the base score alone.

Frequently asked questions