CVE-2026-12223: Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function modwebd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. Upgrading to version 108.87.0.23 addresses this issue. Upgrading the affected component is recommended. The vendor explains: "It has been fixed (...) for our technical support branch. However, please note that this specific support branch firmware is not publicly released yet."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Yealink SIP-T46U Web FastCGI Service (mod_webd.TFTPUploadIperf)to a version that resolves this vulnerability.Fixed in 108.87.0.23 - Compensating control
Because the attack needs to be initiated within the local network, restrict access to the Yealink device (especially the Web FastCGI Service endpoints used by /api/inner/tftpuploadiperf) to trusted/local hosts only (e.g., via firewall/ACL) until upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12223?
The severity of CVE-2026-12223 is classified as medium with a score of 5.5.
What type of vulnerability is CVE-2026-12223?
CVE-2026-12223 is a command injection vulnerability affecting the Yealink SIP-T46U Web FastCGI Service.
How do I fix CVE-2026-12223?
To fix CVE-2026-12223, update the Yealink SIP-T46U firmware to the latest version that addresses this vulnerability.
What component is affected by CVE-2026-12223?
CVE-2026-12223 affects the mod_webd.TFTPUploadIperf function within the Web FastCGI Service component.
Can CVE-2026-12223 be exploited remotely?
Yes, CVE-2026-12223 can be exploited remotely due to its nature of command injection with user-controllable arguments.