CVE-2026-12222: Yealink SIP-T46U Buffer Overflow Flaw

CVE-2026-12222 Overview

CVE-2026-12222 is a stack-based buffer overflow in the Yealink SIP-T46U IP phone running firmware version 108.86.0.118. The flaw resides in the mod_webd.BlueToothTest function processing requests to /api/inner/bttest within the Web FastCGI Service component. Attackers can manipulate the btMac, pin, or reserved arguments to overflow a stack buffer. Exploitation requires adjacent network access and low-privilege authentication. The exploit has been publicly disclosed, and the vendor did not respond to early disclosure attempts. The weakness is tracked under CWE-119 for improper restriction of operations within memory buffer bounds.

Critical Impact
A successful exploit corrupts the stack of the FastCGI handler, enabling code execution or denial of service on the phone, with high impact to confidentiality, integrity, and availability.

Affected Products

Yealink SIP-T46U IP Phone
Firmware version 108.86.0.118
Web FastCGI Service component (mod_webd)

Discovery Timeline

2026-06-15 - CVE-2026-12222 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
Public exploit material published via Off-by-One Vulnerability Exploit archive
Vendor was contacted prior to disclosure and did not respond

Technical Details for CVE-2026-12222

Vulnerability Analysis

The Yealink SIP-T46U exposes an internal Bluetooth test endpoint at /api/inner/bttest, handled by the mod_webd.BlueToothTest routine inside the Web FastCGI Service. The handler accepts three user-controlled parameters: btMac, pin, and reserved. The routine copies these parameters into fixed-size stack buffers without enforcing correct length boundaries. An off-by-one or oversized write corrupts adjacent stack data, including saved frame pointers and return addresses.

Because the affected service runs as part of the phone's web management interface, a successful overflow can subvert control flow within a privileged process. The attacker must already hold low-privilege credentials on the device and be positioned on the adjacent network, such as the same LAN segment or VLAN as the phone.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer ([CWE-119]). The BlueToothTest function trusts the length of attacker-supplied strings and writes them into stack-resident buffers without enforcing maximum size. Refer to the VulDB CVE-2026-12222 Entry for additional technical context.

Attack Vector

An authenticated attacker on the adjacent network issues a crafted HTTP request to /api/inner/bttest, supplying oversized values for btMac, pin, or reserved. The Web FastCGI Service deserializes the parameters and invokes the vulnerable function, triggering the stack write. No user interaction is required.

No verified code examples are available for inclusion. The exploitation mechanism is documented in the VulDB Vulnerability #370865 entry and the publicly distributed proof-of-concept archive referenced above.

Detection Methods for CVE-2026-12222

Indicators of Compromise

HTTP POST or GET requests to /api/inner/bttest containing abnormally long btMac, pin, or reserved parameter values
Unexpected restarts or crash logs originating from the mod_webd FastCGI process on Yealink SIP-T46U devices
Authenticated sessions from unusual internal hosts targeting Yealink phone management interfaces

Detection Strategies

Inspect web access logs from Yealink phones for requests targeting the /api/inner/bttest path, which is an internal endpoint and should rarely appear in normal traffic.
Alert on parameter values that exceed plausible lengths for a Bluetooth MAC address (17 characters) or PIN code.
Correlate failed or repeated authentication attempts to the phone's web interface with subsequent requests to Bluetooth test endpoints.

Monitoring Recommendations

Forward Yealink phone syslog and HTTP access logs to a centralized log platform for retention and analysis.
Monitor LAN segments hosting VoIP devices for lateral movement, especially from workstations to phone management ports (typically TCP/80 and TCP/443).
Track firmware versions across the VoIP fleet to identify devices still running 108.86.0.118.

How to Mitigate CVE-2026-12222

Immediate Actions Required

Restrict access to the Yealink SIP-T46U web management interface using network ACLs, limiting it to a dedicated management VLAN.
Rotate administrator and user credentials on affected phones to reduce the value of low-privilege accounts an attacker would need.
Block the /api/inner/bttest endpoint at any reverse proxy or web application firewall fronting the device.
Audit the VoIP network for unauthorized devices that could reach the phones over the adjacent network.

Patch Information

No vendor patch is currently available. Yealink did not respond to the original disclosure according to the VulDB CVE-2026-12222 Entry. Operators should monitor Yealink's security bulletins for an updated firmware release superseding 108.86.0.118 and apply it as soon as it becomes available.

Workarounds

Place SIP-T46U phones on an isolated voice VLAN with strict inter-VLAN ACLs that deny traffic from user workstations to the phone management interfaces.
Disable Bluetooth-related functionality where operationally feasible to reduce reliance on the affected handler.
Enforce strong, unique credentials on every phone and disable any shared low-privilege accounts.
Deploy network intrusion detection signatures that flag oversized parameter values sent to /api/inner/bttest.

bash

# Example ACL concept restricting phone management to a dedicated subnet
# Replace 10.10.20.0/24 with your management network and 10.30.0.0/16 with your voice VLAN
access-list VOICE_MGMT permit tcp 10.10.20.0 0.0.0.255 10.30.0.0 0.0.255.255 eq 80
access-list VOICE_MGMT permit tcp 10.10.20.0 0.0.0.255 10.30.0.0 0.0.255.255 eq 443
access-list VOICE_MGMT deny   tcp any 10.30.0.0 0.0.255.255 eq 80
access-list VOICE_MGMT deny   tcp any 10.30.0.0 0.0.255.255 eq 443
access-list VOICE_MGMT permit ip any any