PT-2026-49179 · Yealink · Sip-T46U

Cookedmelon · CVE-2026-12218 · Published 2026-06-15 · Updated 2026-06-27

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yealink SIP-T46U (affected versions not specified)

Description A stack-based buffer overflow exists in the Web FastCGI Service. The issue occurs within the StartReportInformation() function located in the '/api/inner/beforewifitest' endpoint. An attacker with local network access can trigger this by manipulating the port argument. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially leading to crashes or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/inner/beforewifitest' endpoint to minimize the risk of exploitation.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2026-12218

Affected Products

Sip-T46U

References · 10

• 🔥 http://cdn2.v50to.cc/T46U/T46U_beforewifitest_stack_overflow.zip · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12218 · Security Note
• https://vuldb.com/cve/CVE-2026-12218 · Note
• https://vuldb.com/vuln/370861/cti · Note
• https://twitter.com/VulmonFeeds/status/2066428920166015092 · Twitter Post
• https://t.me/cveNotify/177922 · Telegram Post
• https://vuldb.com/submit/834193 · Note
• https://t.me/CVEtracker/56838 · Telegram Post
• https://vuldb.com/vuln/370861 · Note
• https://twitter.com/vuldb/status/2066415809346544034 · Twitter Post