CVE-2026-12222
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was found in Yealink SIP-T46U version 108.86.0.118 in the mod_webd.BlueToothTest function in the file /api/inner/bttest of the Web FastCGI Service. Manipulation of the btMac, pin, or reserved arguments can lead to a stack-based buffer overflow. The attack requires local network access and the exploit has been publicly disclosed.
Risk Assessment
The risk for the organization is the possibility of remote code execution or device crash by an attacker on the local network, which could lead to takeover of the VoIP phone and potential eavesdropping or communication disruption.
Recommendation
It is recommended to immediately restrict access to the Web FastCGI interface to trusted hosts only on the local network and monitor for a patch from the vendor. Apply the fix as soon as it becomes available.
Original NVD description (English source)
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and is working on a patch to fix it.