Yealink SIP-T46U vulnerabilities

A vulnerability in Yealink SIP-T46U 108.86.0.118. The mod_webd.TFTPUploadIperf function in /api/inner/tftpuploadiperf of the Web FastCGI Service component allows command injection via ip/port arguments. Local network attack, exploit public. Fixed in version 108.87.0.23.

Vulnerability in Yealink SIP-T46U version 108.86.0.118 in the Web FastCGI Service component (mod_webd.BlueToothTest function in /api/inner/bttest). Manipulation of btMac/pin/reserved arguments leads to stack-based buffer overflow. Attack requires local network access.

Vulnerability in Yealink SIP-T46U version 108.86.0.118 in the Firmware Chunk Upload Handler component (sprintf function in /api/upgrade/upgrade). Manipulation of uid/start_offset arguments leads to stack-based buffer overflow. Attack requires local network access.

Vulnerability in Yealink SIP-T46U version 108.86.0.118 in the Firmware Chunk Upload Handler component (mod_upgrade.SparePartsUpload function in /api/upgrade/accupgradebychunk). Manipulation of uid argument leads to stack-based buffer overflow. Attack requires local network access.

A vulnerability has been found in Yealink SIP-T46U version 108.86.0.118, allowing command injection in the mod_diagnose.CommandShellByType function of /api/diagnosis/start. The attack can be launched remotely by manipulating the Time argument. The issue is fixed in version 108.87.0.23.

Vulnerability in Yealink SIP-T46U version 108.87.50.1 in the Web FastCGI Service component (StartReportInformation function in /api/inner/beforewifitest). Manipulation of port argument leads to stack-based buffer overflow. Attack requires local network access.