Log in Start free

Vulnerability · Published Jun 15, 2026 · Assigned by VulDB

CVE-2026-12223Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection

Medium 5.5

In plain English

A medium-severity command injection in SIP-T46U from Yealink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.2%top 31.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner/tftpuploadiperf of the component Web FastCGI Service. The manipulation of the argument ip/port leads to command injection. The attack needs to be initiated within the local network. The exploit is publicly available and might be used. Upgrading to version 108.87.0.23 addresses this issue. Upgrading the affected component is recommended. The vendor explains: "It has been fixed (...) for our technical support branch. However, please note that this specific support branch firmware is not publicly released yet."

Affected products (as reported)

VendorProductVersions
Yealink SIP-T46U 108.86.0.118

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References