CVE-2026-12221: Yealink SIP-T46U Buffer Overflow Flaw

CVE-2026-12221 Overview

CVE-2026-12221 is a stack-based buffer overflow [CWE-119] affecting the Yealink SIP-T46U IP desk phone running firmware version 108.86.0.118. The vulnerability resides in the sprintf call inside the /api/upgrade/upgrade endpoint, which is part of the Firmware Chunk Upload Handler. Attackers can trigger the overflow by manipulating the uid or start_offset arguments during a chunked firmware upload. Exploitation requires adjacent network access and low-level authenticated privileges on the device. A public exploit package has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
An attacker on the local network can corrupt the stack of the firmware upgrade service, leading to potential arbitrary code execution and full compromise of confidentiality, integrity, and availability on affected Yealink SIP-T46U phones.

Affected Products

Yealink SIP-T46U IP phone, firmware version 108.86.0.118
Component: Firmware Chunk Upload Handler (/api/upgrade/upgrade)
Vulnerable function: sprintf processing uid / start_offset parameters

Discovery Timeline

2026-06-15 - CVE-2026-12221 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
2026-06-18 - EPSS score recorded at 0.371% (percentile 28.75)

Technical Details for CVE-2026-12221

Vulnerability Analysis

The Yealink SIP-T46U exposes a firmware upgrade API at /api/upgrade/upgrade that accepts multi-part chunked uploads. The handler reads attacker-controlled fields, notably uid and start_offset, and passes them into a sprintf call without bounding the destination buffer. Because sprintf performs no length checks, oversized values for either field write past the end of a fixed-size stack buffer.

The resulting stack corruption can overwrite saved return addresses and adjacent local variables in the upgrade service process. An attacker who controls the layout of the overflowing data can redirect execution flow, leading to arbitrary code execution in the context of the upgrade handler. Because the device runs the affected service with elevated privileges to write firmware images, successful exploitation undermines confidentiality, integrity, and availability of the phone.

A public exploit package titled T46U_mod_upgrade_Upgrade_chunk_stack_overflow.zip is referenced by VulDB, increasing the likelihood of opportunistic abuse in enterprise voice networks.

Root Cause

The root cause is the unsafe use of sprintf with attacker-controlled inputs in the firmware chunk upload routine. The function formats request-derived strings, including uid and start_offset, into a fixed-size stack buffer without using a bounded variant such as snprintf and without validating input length against the destination size. This pattern is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Attack Vector

The attack vector is Adjacent Network, meaning the attacker must be on the same Layer 2 segment, VLAN, or VPN as the target phone. The attacker authenticates with low-privilege credentials to the device's web/management API, then issues a crafted chunked POST request to /api/upgrade/upgrade with oversized uid or start_offset parameter values. No user interaction is required. The vulnerability manifests during request parsing inside the upgrade service, before any signature or integrity validation of the firmware blob itself. Public proof-of-concept material from VulDB demonstrates the overflow trigger; the linked archive contains the crafted request structure needed to reach the vulnerable sprintf.

Detection Methods for CVE-2026-12221

Indicators of Compromise

HTTP requests to /api/upgrade/upgrade containing unusually long uid or start_offset parameter values
Unexpected crashes, restarts, or watchdog resets of the upgrade service on Yealink SIP-T46U phones
Firmware upgrade traffic originating from non-administrative hosts inside the voice VLAN
Outbound connections from SIP phones to unfamiliar IP addresses following an upgrade API request

Detection Strategies

Inspect HTTP and HTTPS traffic to Yealink management endpoints for parameter values exceeding expected lengths, particularly uid and start_offset
Alert when firmware upgrade endpoints are accessed by source addresses outside the approved provisioning server list
Correlate phone reboots or service restarts with preceding requests to /api/upgrade/upgrade

Monitoring Recommendations

Enable syslog forwarding from Yealink devices to a central log platform and monitor for upgrade-related errors
Capture NetFlow or packet metadata on the voice VLAN to baseline normal upgrade behavior
Track authentication events against phone management interfaces to identify low-privilege account abuse

How to Mitigate CVE-2026-12221

Immediate Actions Required

Restrict management and HTTP/HTTPS access to Yealink SIP-T46U phones to a dedicated, isolated provisioning VLAN
Rotate and harden credentials for all local accounts on the phones, removing any default or shared low-privilege users
Disable remote firmware upgrade functionality where it is not actively required by operations
Monitor for and block the public exploit archive referenced in VulDB CVE-2026-12221 at the network perimeter

Patch Information

No vendor patch is available at the time of publication. According to the NVD record, Yealink was contacted about the disclosure but did not respond. Administrators should track the VulDB Vulnerability #370864 entry and the Yealink security advisory page for future firmware updates that supersede version 108.86.0.118.

Workarounds

Place all SIP-T46U phones on a segmented voice VLAN with strict ACLs preventing user workstations from reaching phone management ports
Terminate phone provisioning traffic on an internal reverse proxy that enforces parameter length limits on /api/upgrade/upgrade requests
Require 802.1X or MAC-based authentication on switch ports used by SIP phones to limit adjacent-network exposure
Disable web-based management on phones in production and rely on signed auto-provisioning files delivered from a trusted server

bash

# Example ACL fragment restricting Yealink phone management to a single provisioning host
# Replace VOICE_VLAN_SUBNET and PROVISIONING_SERVER with site-specific values
ip access-list extended YEALINK-MGMT
 permit tcp host PROVISIONING_SERVER VOICE_VLAN_SUBNET 0.0.0.255 eq 443
 permit tcp host PROVISIONING_SERVER VOICE_VLAN_SUBNET 0.0.0.255 eq 80
 deny   tcp any VOICE_VLAN_SUBNET 0.0.0.255 eq 443
 deny   tcp any VOICE_VLAN_SUBNET 0.0.0.255 eq 80
 permit ip any any