CVE-2026-12220: Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow

Synopsis

A stack-based buffer overflow exists in the Yealink SIP-T46U IP phone firmware (version 108.86.0.118), specifically in the firmware chunk upload handler at the /api/upgrade/accupgradebychunk endpoint, within the mod_upgrade.SparePartsUpload function. The vulnerability is reachable from adjacent networks (LAN, VPN, or similar local network segments) and requires a low-privilege account to exploit. Successful exploitation gives an attacker full control over the device, including the ability to read, modify, or disrupt its operation. No fix version has been published; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as the upstream vendor ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on an adjacent network such as a LAN, VLAN, or VPN; the endpoint is not reachable from the open internet.

• AuthenticationRequired

  A low-privilege account on the device is sufficient to reach the vulnerable endpoint; anonymous unauthenticated access is not enough.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the overflow by sending a crafted request directly to the firmware upload endpoint.

• Attack complexityDetail

  Exploitation is reliable and condition-free with no race conditions or special environmental factors required (AC:L).

Blast Radius

• Reads sensitive data stored on the device, including configuration files, SIP credentials, and call logs (VC:H).
• Modifies device configuration and firmware state, enabling persistent backdoors or rerouting of SIP traffic (VI:H).
• Crashes or fully disrupts the phone's operation, taking the device offline and denying voice service to its users (VA:H).
• An attacker with control over a phone on an internal network segment can use it as a pivot point to probe other adjacent devices on the same LAN.