CVE-2026-12221: Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow

Synopsis

A stack-based buffer overflow affects the Firmware Chunk Upload Handler in Yealink SIP-T46U firmware version 108.86.0.118. The flaw is in the sprintf call processing the uid and start_offset arguments at the /api/upgrade/upgrade endpoint, reachable from within the local network by a low-privileged authenticated user. Successful exploitation gives an attacker full control over the affected device, including the ability to read, modify, or crash it. No vendor patch has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The endpoint is reachable only from within the local network (LAN or equivalent adjacent segment), not directly from the public internet.

• AuthenticationRequired

  The attacker must be authenticated with at least a low-privilege account on the device to reach the Firmware Chunk Upload Handler.

• Victim interactionNot required

  No victim action is needed; the attacker triggers the overflow directly by sending a crafted request to the upgrade endpoint.

• Attack complexityDetail

  Exploit conditions are reliable and free of special environmental requirements, making the overflow straightforward to trigger once network access and credentials are obtained.

Blast Radius

• The attacker gains full read access to data stored on the device, including credentials, configuration, and session material.
• The attacker can modify persisted device configuration or replace firmware, altering device behavior and potentially establishing persistence.
• The attacker can crash the device or render it unresponsive, disrupting voice communications for users depending on it.
• A proof-of-concept exploit is publicly available, lowering the skill bar required and increasing the likelihood of active exploitation attempts.