A vulnerability was found in Yealink SIP-T46U 108

CVE-2026-12221 is a stack-based buffer overflow in the Yealink SIP-T46U firmware upgrade handler at /api/upgrade/upgrade, triggered by crafted uid or start_offset input to sprintf. Public reporting currently ties the issue to firmware 108.86.0.118 specifically, not a broad T4U family range. The attack path is not internet-native; public descriptions say it must be launched from the local/adjacent network, and the phone web interface is typically reachable only from the same network segment or voice VLAN.

The vendor-style HIGH/8.0 baseline overstates enterprise urgency because it prices the memory corruption heavily but underprices the reachability friction. In the real world, an attacker usually needs to already be on the voice network and have at least low-privileged access to the phone's admin surface; that means this is more of a post-compromise amplifier against a handset than a fleet-opening edge bug.

Why this verdict

• Baseline starts high: memory corruption in upgrade code with C/I/A impact on a widely deployed handset deserves respect; I started from the vendor's 8.0 HIGH rather than hand-waving it away.
• Reachability penalty: AV:A means the attacker needs same-network/adjacent access. In enterprise terms that usually means the voice VLAN, a bridged LAN segment, or another already-compromised internal foothold. That is a major downward adjustment because it assumes a prior stage of compromise or unusually weak segmentation.
• Auth penalty: PR:L means the exploit path is not anonymous spray-and-pray. T46U admin docs and support material show a managed web interface for firmware actions; if the org rotated passwords or disabled the web server, the reachable population drops again.
• Exposure penalty: desk phones are commonly internal-only assets. Public support guidance explicitly describes same-network web access and optional web-server disablement, which is the opposite of an internet-edge blast radius.
• Detection/weaponization penalty: a public PoC exists, but I found no KEV listing, no campaign reporting, and no evidence of turnkey mass exploitation. That keeps this out of HIGH despite the underlying bug class.
• Role multiplier: low-value role — on a standard desk phone, the chain succeeds only to the handset/extension context; realistic blast radius is host or single extension, not tenant or fleet.
• Role multiplier: typical role — on a normal office T46U in a voice VLAN, the chain can still succeed, but blast radius remains phone + SIP identity unless you already have additional PBX/admin weaknesses to chain with it.
• Role multiplier: high-value role — this product is not a canonical high-value control-plane component like an IdP, hypervisor, backup server, or edge firewall. Even on an executive or receptionist handset, the documented chain still lands on the phone, so there is no verdict floor forcing HIGH.

Why not higher?

It is not higher because the path is neither unauthenticated internet-facing nor clearly tied to active exploitation. Just as important, the affected component is a desk phone, not an identity, backup, hypervisor, PKI, or network-edge role where one successful exploit routinely becomes fleet compromise.

Why not lower?

It is not lower because this is still memory corruption in firmware administration code with a public PoC claim and high theoretical impact on the target device. If your voice VLAN is flat, if web admin is left enabled, or if default credentials survived provisioning, the practical friction shrinks fast.

1. Disable the phone web UI where you do not need it — Turn off HTTP/HTTPS administration on T46U handsets that are not actively managed through the local web interface. This removes the vulnerable surface instead of just hoping nobody reaches it; for a MEDIUM verdict there is no mitigation SLA, so do this in the next normal voice-platform admin cycle.
2. Rotate handset admin credentials — Eliminate any inherited or default admin/admin exposure and store the new credentials in your voice-management vault. This directly attacks the PR:L prerequisite; for a MEDIUM verdict there is no mitigation SLA, so complete it during standard credential hygiene work.
3. Restrict management access to a voice-admin subnet — ACL the phone web interface so only your provisioning server or jump host can reach it, and block user LANs and guest networks from talking to handset admin ports. This is the cleanest real-world reduction in exposed population; for MEDIUM, there is no mitigation SLA, so roll it into your routine network-change window.
4. Audit T46U firmware versions now — Identify every handset still on 108.86.0.118 so you know the true blast radius before scheduling remediation. For MEDIUM there is no mitigation SLA — use normal inventory and voice-ops cadence, but do not leave version uncertainty unresolved.
5. Plan upgrade validation on a lab handset — Because I found no authoritative vendor statement tying a fixed build to this CVE, test a newer branch such as 108.87.0.22 in lab and get written confirmation from Yealink or your reseller before mass rollout. For MEDIUM, this belongs in the normal remediation program rather than emergency change.

Run this from an auditor workstation or jump host on the same LAN/voice VLAN as the phone. Invoke it as ./check_t46u_cve_2026_12221.sh https://192.168.1.22 admin admin; it needs network reachability to the handset web UI and works best with valid handset credentials, but it will still try unauthenticated fetches and return UNKNOWN if it cannot prove the firmware build.

#!/usr/bin/env bash
# check_t46u_cve_2026_12221.sh
# Purpose: best-effort check for Yealink SIP-T46U firmware build associated with CVE-2026-12221.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown, 3=usage/network error

set -u

TARGET="${1:-}"
USER="${2:-}"
PASS="${3:-}"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <http[s]://phone-ip> [username] [password]" >&2
  exit 3
fi

if ! command -v curl >/dev/null 2>&1; then
  echo "UNKNOWN - curl not installed" >&2
  exit 2
fi

AUTH=()
if [[ -n "$USER" || -n "$PASS" ]]; then
  AUTH=(--user "$USER:$PASS")
fi

fetch() {
  local url="$1"
  curl -ksS --connect-timeout 5 --max-time 10 "${AUTH[@]}" "$url" 2>/dev/null || true
}

BASE="${TARGET%/}"
DATA=""
DATA+="$(fetch "$BASE/")"
DATA+=$'\n'
DATA+="$(fetch "$BASE/servlet?m=mod_data&p=status&q=load")"
DATA+=$'\n'
DATA+="$(fetch "$BASE/cgi-bin/cgiServer.exx?action=getInfo")"

if [[ -z "$DATA" ]]; then
  echo "UNKNOWN - no HTTP response from target"
  exit 2
fi

# Normalize whitespace for easier matching.
DATA="$(printf '%s' "$DATA" | tr '\r' '\n')"

# Exact build publicly associated with CVE-2026-12221.
if printf '%s' "$DATA" | grep -Eq '\b108\.86\.0\.118\b'; then
  echo "VULNERABLE - detected firmware 108.86.0.118"
  exit 1
fi

# Best-effort newer-train check. Public sources show 108.87.0.22 exists,
# but no authoritative vendor advisory was found explicitly mapping that build
# to this CVE. Treat as PATCHED only in the narrow sense of 'not the known affected build'.
if printf '%s' "$DATA" | grep -Eq '\b108\.87\.[0-9]+\.[0-9]+\b'; then
  VER="$(printf '%s' "$DATA" | grep -Eo '\b108\.87\.[0-9]+\.[0-9]+\b' | head -n1)"
  echo "PATCHED - detected newer firmware train $VER (not the known affected build 108.86.0.118)"
  exit 0
fi

# Generic Yealink build extraction for operator context.
VER_ANY="$(printf '%s' "$DATA" | grep -Eo '\b[0-9]{2,3}\.[0-9]{2}\.[0-9]\.[0-9]{1,3}\b' | head -n1 || true)"
if [[ -n "$VER_ANY" ]]; then
  echo "UNKNOWN - detected firmware $VER_ANY, but could not map it confidently to CVE-2026-12221"
  exit 2
fi

echo "UNKNOWN - could not determine firmware version from handset web responses"
exit 2

Sources

1. VulDB entry for CVE-2026-12221
2. cvefeed summary and reference trail
3. Yealink T46U configuration manual (web UI login defaults)
4. Telebroad T46U web UI access article (same-network access, web server enable/disable)
5. Yealink 3CX resource page listing newer T46U firmware
6. Yealink T46U product technical specs
7. FIRST EPSS project
8. CISA Known Exploited Vulnerabilities catalog