CVE-2026-12223: Yealink SIP-T46U RCE Vulnerability

CVE-2026-12223 Overview

CVE-2026-12223 is a command injection vulnerability in the Yealink SIP-T46U IP phone running firmware version 108.86.0.118. The flaw resides in the mod_webd.TFTPUploadIperf function exposed via the /api/inner/tftpuploadiperf endpoint of the Web FastCGI Service. Attackers with low privileges on the adjacent network can manipulate the ip and port arguments to inject and execute arbitrary operating system commands. The exploit is publicly available, and the vendor did not respond to early disclosure attempts. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated adjacent-network attackers can execute arbitrary commands on the phone via crafted ip or port parameters, with a public exploit already circulating and no vendor patch available.

Affected Products

Yealink SIP-T46U firmware 108.86.0.118
Component: Web FastCGI Service (mod_webd)
Endpoint: /api/inner/tftpuploadiperf

Discovery Timeline

2026-06-15 - CVE-2026-12223 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12223

Vulnerability Analysis

The vulnerability resides in the mod_webd.TFTPUploadIperf handler within the Yealink SIP-T46U Web FastCGI Service. The handler processes requests to /api/inner/tftpuploadiperf that supply an IP address and port intended for a TFTP upload triggered through the iperf utility. User-supplied values for the ip and port parameters are passed to a downstream shell invocation without sufficient neutralization of metacharacters. As a result, an authenticated attacker on the adjacent network can append shell operators such as ;, |, or ` to execute arbitrary commands on the device. The EPSS score is 1.527% (71.4 percentile), reflecting moderate near-term exploitation likelihood given the publicly available proof of concept.

Root Cause

The handler concatenates attacker-controlled ip and port strings directly into a command line consumed by a shell interpreter. No allowlist validation, escaping, or use of safe execve-style APIs is performed. This pattern matches [CWE-74] injection: special characters are forwarded unchanged to a downstream component that interprets them as control syntax rather than data.

Attack Vector

Exploitation requires network reachability to the phone's web interface and a low-privilege authenticated session. The attacker sends a crafted HTTP request to /api/inner/tftpuploadiperf with shell metacharacters embedded in the ip or port argument. The injected payload runs in the context of the FastCGI worker, providing local code execution on the embedded device. A weaponized sample referenced as T46U_mod_webd_TFTPUploadIperf_system_exec.zip is hosted on a public mirror. No verified exploitation code is reproduced here; refer to the VulDB Vulnerability Report for technical specifics.

Detection Methods for CVE-2026-12223

Indicators of Compromise

HTTP requests to /api/inner/tftpuploadiperf containing shell metacharacters (;, &, |, `, $()) in the ip or port query parameters.
Outbound TFTP or unexpected child processes spawned from the mod_webd FastCGI worker on the phone.
Presence of artifacts matching the public sample bundle T46U_mod_webd_TFTPUploadIperf_system_exec.zip.

Detection Strategies

Inspect web server and FastCGI access logs for POST or GET requests targeting /api/inner/tftpuploadiperf with non-numeric port values or non-IP ip values.
Deploy network IDS signatures that flag HTTP payloads containing shell operators directed at Yealink management endpoints.
Correlate authentication events on Yealink devices with subsequent calls to the tftpuploadiperf API to surface low-privilege accounts probing the handler.

Monitoring Recommendations

Centralize syslog from VoIP phones and management VLANs into a SIEM for parameter-level inspection of inner API calls.
Baseline normal traffic to /api/inner/* endpoints and alert on deviations in request frequency, source, or argument structure.
Monitor adjacent-network segments hosting IP phones for lateral scanning, brute-force authentication, or unexpected egress originating from phone IPs.

How to Mitigate CVE-2026-12223

Immediate Actions Required

Restrict access to the Yealink web management interface to dedicated administrative VLANs and trusted hosts only.
Rotate all local credentials on SIP-T46U devices and disable unused or default low-privilege accounts that can reach inner APIs.
Block external and inter-VLAN HTTP/HTTPS traffic to /api/inner/tftpuploadiperf at the network boundary until a vendor fix is available.

Patch Information

No vendor patch is currently available. According to the disclosure, Yealink was contacted early but did not respond. Affected operators should track the VulDB CVE-2026-12223 entry and the Yealink support portal for future firmware updates beyond 108.86.0.118.

Workarounds

Place IP phones on a segmented voice VLAN with strict ACLs preventing user workstations from reaching phone management endpoints.
Disable the web interface on phones that do not require it, or bind it to localhost where supported by the firmware.
Enforce 802.1X authentication on switch ports serving phones to limit which devices can reach the adjacent network where exploitation is possible.

bash

# Example ACL restricting access to the vulnerable endpoint
# Replace 10.10.20.0/24 with your VoIP management subnet
iptables -A FORWARD -p tcp -d <phone_ip> --dport 443 \
  -m string --algo bm --string "/api/inner/tftpuploadiperf" \
  ! -s 10.10.20.0/24 -j DROP