CVE-2026-12218: Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow
A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12218?
CVE-2026-12218 has a high severity rating of 8.
What type of vulnerability is CVE-2026-12218?
CVE-2026-12218 is classified as a stack-based buffer overflow.
How do I fix CVE-2026-12218?
To mitigate CVE-2026-12218, update the firmware of Yealink SIP-T46U to the latest version.
What component is affected by CVE-2026-12218?
CVE-2026-12218 affects the Web FastCGI Service in the Yealink SIP-T46U.
What can attackers gain from exploiting CVE-2026-12218?
Exploiting CVE-2026-12218 can allow attackers to execute arbitrary code on the vulnerable device.