CVE-2026-12222: Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow

Published Jun 15, 2026

Updated

A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function modwebd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs to be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and is working on a patch to fix it.

Affected Software

2 affected components

Yealink SIP-T46U=108.86.0.118

Yealink Web FastCGI Service /api/inner/bttest (mod_webd.BlueToothTest)

Event History

Jun 15, 2026

CVE Published

via MITRE·05:15 AM

Data Sourced

via MITRE·05:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Oct 17, 58423

Event

via NVD·08:55 PM

Frequently Asked Questions

What is the severity of CVE-2026-12222?

The severity of CVE-2026-12222 is rated as high with a score of 8.

How do I fix CVE-2026-12222?

To fix CVE-2026-12222, update the Yealink SIP-T46U to the latest firmware version provided by the vendor.

What impact does CVE-2026-12222 have on security?

CVE-2026-12222 can potentially allow an attacker to execute arbitrary code through a stack-based buffer overflow.

Which product is affected by CVE-2026-12222?

CVE-2026-12222 affects the Yealink SIP-T46U with the firmware version 108.86.0.118.

What components are involved in CVE-2026-12222?

CVE-2026-12222 involves the Web FastCGI Service and specifically the mod_webd.BlueToothTest function.