PT-2026-49179 · Yealink · Sip-T46U

Cookedmelon · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-12218

NVD

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Buffer Overflow

Stack Overflow

Weakness Enumeration

CWE-119

CWE-121

Related Identifiers

CVE-2026-12218

Affected Products

Sip-T46U

References · 6

• 🔥 http://cdn2.v50to.cc/T46U/T46U_beforewifitest_stack_overflow.zip · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12218 · Security Note
• https://vuldb.com/vuln/370861 · Note
• https://vuldb.com/submit/834193 · Note
• https://vuldb.com/cve/CVE-2026-12218 · Note
• https://vuldb.com/vuln/370861/cti · Note