Yealink SIP-T46U firmware upgrade handler stack-based buffer overflow

#!/usr/bin/env bash
# check_t46u_cve_2026_12221.sh
# Purpose: best-effort check for Yealink SIP-T46U firmware build associated with CVE-2026-12221.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown, 3=usage/network error

set -u

TARGET="${1:-}"
USER="${2:-}"
PASS="${3:-}"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <http[s]://phone-ip> [username] [password]" >&2
  exit 3
fi

if ! command -v curl >/dev/null 2>&1; then
  echo "UNKNOWN - curl not installed" >&2
  exit 2
fi

AUTH=()
if [[ -n "$USER" || -n "$PASS" ]]; then
  AUTH=(--user "$USER:$PASS")
fi

fetch() {
  local url="$1"
  curl -ksS --connect-timeout 5 --max-time 10 "${AUTH[@]}" "$url" 2>/dev/null || true
}

BASE="${TARGET%/}"
DATA=""
DATA+="$(fetch "$BASE/")"
DATA+=$'\n'
DATA+="$(fetch "$BASE/servlet?m=mod_data&p=status&q=load")"
DATA+=$'\n'
DATA+="$(fetch "$BASE/cgi-bin/cgiServer.exx?action=getInfo")"

if [[ -z "$DATA" ]]; then
  echo "UNKNOWN - no HTTP response from target"
  exit 2
fi

# Normalize whitespace for easier matching.
DATA="$(printf '%s' "$DATA" | tr '\r' '\n')"

# Exact build publicly associated with CVE-2026-12221.
if printf '%s' "$DATA" | grep -Eq '\b108\.86\.0\.118\b'; then
  echo "VULNERABLE - detected firmware 108.86.0.118"
  exit 1
fi

# Best-effort newer-train check. Public sources show 108.87.0.22 exists,
# but no authoritative vendor advisory was found explicitly mapping that build
# to this CVE. Treat as PATCHED only in the narrow sense of 'not the known affected build'.
if printf '%s' "$DATA" | grep -Eq '\b108\.87\.[0-9]+\.[0-9]+\b'; then
  VER="$(printf '%s' "$DATA" | grep -Eo '\b108\.87\.[0-9]+\.[0-9]+\b' | head -n1)"
  echo "PATCHED - detected newer firmware train $VER (not the known affected build 108.86.0.118)"
  exit 0
fi

# Generic Yealink build extraction for operator context.
VER_ANY="$(printf '%s' "$DATA" | grep -Eo '\b[0-9]{2,3}\.[0-9]{2}\.[0-9]\.[0-9]{1,3}\b' | head -n1 || true)"
if [[ -n "$VER_ANY" ]]; then
  echo "UNKNOWN - detected firmware $VER_ANY, but could not map it confidently to CVE-2026-12221"
  exit 2
fi

echo "UNKNOWN - could not determine firmware version from handset web responses"
exit 2