CVE-2026-12218: Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow

Synopsis

A stack-based buffer overflow affects the Yealink SIP-T46U IP phone (firmware 108.87.50.1) in the Web FastCGI Service's StartReportInformation function, reachable via the /api/inner/beforewifitest endpoint. The vulnerability is triggered by manipulating the port argument over the local network, and requires a low-privilege account to exploit. Successful exploitation gives an attacker full read, write, and crash capability over the affected device. No fix has been published; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same local network, LAN segment, or VPN as the target device; remote internet-based access is not sufficient.

• AuthenticationRequired

  A low-privilege account on the device's Web FastCGI Service is required; unauthenticated access to the vulnerable endpoint is not sufficient.

• Victim interactionNot required

  No user interaction is needed; the attacker sends a crafted request directly to the vulnerable endpoint without any action from a logged-in user.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental state required beyond network adjacency and a valid low-privilege credential.

Blast Radius

• An attacker can read all data accessible to the FastCGI service process, including stored credentials, SIP account details, and configuration secrets on the phone.
• An attacker can overwrite memory and persistent configuration, allowing modification of call routing, SIP registrar settings, or admin credentials.
• An attacker can crash the Web FastCGI Service, taking the phone's management interface and potentially its call functionality offline.
• A public proof-of-concept exploit is already circulating, lowering the bar for any attacker with LAN access to weaponize this overflow.