CVE-2026-12223: Yealink SIP-T46U Command Injection Vulnerability in Web Service

Technical summary

The vulnerability exists in the mod_webd.TFTPUploadIperf function within the Web FastCGI Service component. It processes the /api/inner/tftpuploadiperf endpoint and fails to properly sanitize the ip and port parameters, allowing an attacker to inject shell commands that are then executed by the web service process. The flaw is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-77 (Improper Neutralization of Special Elements used in a Command). The attack vector requires local network proximity and valid authentication credentials, limiting exposure to internal-only threats.

Business impact

Compromise of Yealink phones in enterprise environments could expose sensitive voice communications, allow unauthorized use of the device for lateral network reconnaissance, or disrupt VoIP service availability. Because these phones often sit on converged networks with corporate data systems, a compromised endpoint could serve as a pivot point for further attacks. However, the requirement for local network access and authentication credentials substantially constrains the blast radius compared to remote-unauthenticated vulnerabilities.

Affected systems

Yealink SIP-T46U devices running firmware version 108.86.0.118 are confirmed vulnerable. Organizations should inventory their Yealink phone deployments and identify which models and firmware versions are in use, particularly any SIP-T46U units. The vendor's firmware version listing should be checked to determine the precise scope in your environment.

Exploitability

Exploitation requires an attacker with both local network access and valid user credentials on the device or its authentication domain. While a public exploit exists, the prerequisite authentication barrier significantly limits opportunistic exploitation. This is not an easy remote unauthenticated attack; it represents a local insider risk or a risk from an attacker who has already compromised network access.

Remediation

Upgrade Yealink SIP-T46U devices to firmware version 108.87.0.23 or later. The vendor has confirmed the fix is available in their technical support branch; verify the availability and release status of this firmware through your Yealink support channel or account team before deployment. Organizations unable to upgrade immediately should restrict administrative access to the devices and limit local network exposure to trusted personnel only.

Patch guidance

Contact your Yealink technical support representative to obtain firmware version 108.87.0.23. Because the vendor notes this version currently exists only in a technical support branch and is not yet publicly released, coordinate with Yealink's support organization to confirm availability and obtain signed, validated firmware images. Test patches in a lab environment with representative Yealink models before wide deployment. Plan patching during low-traffic periods to minimize voice service disruption.

Detection guidance

Monitor access logs to the /api/inner/tftpuploadiperf endpoint on Yealink devices, particularly requests containing unusual or shell-like syntax in the ip or port parameters (e.g., backticks, semicolons, pipes, or command substitution characters). Inspect HTTP POST/GET requests for payloads attempting command injection. Segment Yealink phones on a dedicated VLAN if possible to reduce lateral movement risk and simplify logging. Ensure adequate logging of administrative and API-level access to these devices.

Why prioritize this

This vulnerability scores MEDIUM (CVSS 5.5) due to the requirement for local network presence and authentication. It does not appear on the CISA KEV catalog, indicating it is not currently being actively exploited at scale in the wild. However, the existence of public exploit code and the presence of vulnerable phones in many enterprises warrant timely patching. Prioritize this alongside other network device updates, particularly if your organization has a large Yealink footprint or if the affected devices are located in high-security network zones.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a relatively constrained attack scenario: local network requirement (AV:A), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and limited impact to confidentiality, integrity, and availability (C:L/I:L/A:L). Each impact category is rated Low rather than High, because command injection on a single phone endpoint does not typically compromise entire systems. The local and authenticated nature of the attack substantially reduces the score compared to what a remote unauthenticated command injection would receive.

Frequently asked questions