CVE-2026-12218: Yealink SIP-T46U Buffer Overflow Flaw

CVE-2026-12218 Overview

CVE-2026-12218 is a stack-based buffer overflow in the Yealink SIP-T46U IP phone, firmware version 108.87.50.1. The flaw resides in the StartReportInformation function exposed through the /api/inner/beforewifitest endpoint of the Web FastCGI Service. Attackers manipulate the port argument to overflow a stack buffer, corrupting return addresses and adjacent stack data. Exploitation requires adjacent network access and low-privilege authentication. A public exploit archive is available, and the vendor did not respond to the disclosure attempt. The weakness is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
An authenticated attacker on the local network can corrupt stack memory in the Web FastCGI Service, leading to denial of service or arbitrary code execution on the phone.

Affected Products

Yealink SIP-T46U IP Phone
Firmware version 108.87.50.1
Web FastCGI Service component handling /api/inner/beforewifitest

Discovery Timeline

2026-06-15 - CVE-2026-12218 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database
2026-06-18 - Exploit Prediction Scoring System (EPSS) data recorded at 0.371%

Technical Details for CVE-2026-12218

Vulnerability Analysis

The vulnerability exists in the StartReportInformation function within the Web FastCGI Service of the Yealink SIP-T46U. The function processes requests sent to /api/inner/beforewifitest, which is part of the device's Wi-Fi pre-test workflow. Among the parameters parsed from the request body is port, which the function copies onto the stack without enforcing a length boundary. Because the destination buffer has a fixed size, an oversized port value overruns adjacent stack memory, including the saved return address.

Successful exploitation can crash the FastCGI worker and disrupt phone management functions. On an embedded ARM-based phone like the SIP-T46U, attackers controlling the corrupted return address can redirect execution to attacker-staged shellcode or to existing code gadgets, yielding arbitrary code execution within the privileges of the FastCGI process. The exploit requires adjacent network access and a low-privilege account, which limits opportunistic abuse but is realistic in enterprise voice networks where multiple devices share a VLAN.

Root Cause

The root cause is missing bounds checking when the port argument is copied into a stack-allocated buffer inside StartReportInformation. The FastCGI handler trusts attacker-supplied input length, satisfying the conditions described by [CWE-119].

Attack Vector

An attacker who can reach the phone's HTTP management interface on the local or adjacent network sends a crafted request to /api/inner/beforewifitest containing an overlong port value. The handler processes the request, overflows the stack buffer, and corrupts the saved frame data. No user interaction on the device is required, and the public archive T46U_beforewifitest_stack_overflow.zip referenced by VulDB provides the proof of concept.

No verified code examples are available. Refer to the VulDB entry for CVE-2026-12218 and the public proof-of-concept archive for technical specifics.

Detection Methods for CVE-2026-12218

Indicators of Compromise

HTTP POST or GET requests to /api/inner/beforewifitest containing abnormally long port parameter values.
FastCGI worker crashes, repeated restarts, or segmentation faults logged on the SIP-T46U.
Unexpected outbound connections initiated by the phone after suspicious requests to the management interface.

Detection Strategies

Inspect network telemetry for HTTP traffic targeting /api/inner/beforewifitest from non-administrative hosts within the voice VLAN.
Apply intrusion detection signatures that flag port parameter values exceeding a reasonable length such as 16 bytes.
Correlate phone reboots or service restarts with preceding HTTP traffic to administrative endpoints.

Monitoring Recommendations

Forward SIP-T46U syslog and crash data to a central log platform for anomaly review.
Baseline normal management traffic to the phones and alert on deviations, especially from non-management subnets.
Track authentication events on the phone's web interface and investigate low-privilege accounts that issue API calls to internal endpoints.

How to Mitigate CVE-2026-12218

Immediate Actions Required

Restrict access to the phone's HTTP management interface to a dedicated administrative VLAN using firewall or switch ACLs.
Disable or block the /api/inner/beforewifitest endpoint at an upstream proxy if firmware updates are not yet available.
Rotate and audit all phone web interface credentials, removing unused low-privilege accounts.
Monitor Yealink security advisories for a firmware release addressing version 108.87.50.1.

Patch Information

No vendor patch has been published at the time of NVD publication. According to the NVD record, the vendor was contacted before disclosure but did not respond. Operators should track Yealink security advisories and the VulDB tracking entry for updates.

Workarounds

Place SIP-T46U phones on an isolated voice VLAN with no user workstation reachability to the management ports.
Enforce 802.1X or MAC-based access control to prevent unauthorized devices from sharing the voice segment.
Require VPN access for any administrative interaction with the phones rather than exposing the web interface on user networks.
Disable Wi-Fi provisioning workflows if not in use to reduce the attack surface around the beforewifitest handler.

bash

# Example ACL restricting access to SIP-T46U management interface
# Replace 10.10.20.0/24 with the phone subnet and 10.10.99.5 with the admin host
access-list 110 permit tcp host 10.10.99.5 10.10.20.0 0.0.0.255 eq 80
access-list 110 permit tcp host 10.10.99.5 10.10.20.0 0.0.0.255 eq 443
access-list 110 deny   tcp any 10.10.20.0 0.0.0.255 eq 80
access-list 110 deny   tcp any 10.10.20.0 0.0.0.255 eq 443