CVE-2026-12222: Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow

Synopsis

A stack-based buffer overflow affects the Web FastCGI Service on the Yealink SIP-T46U IP phone (firmware 108.86.0.118). The vulnerable function, mod_webd.BlueToothTest, is reachable via the /api/inner/bttest endpoint over a local network and requires a low-privilege account to call. Successful exploitation gives an attacker full read, write, and crash capability over the affected device. No patch has been published; HarborGuard tracks this advisory for fix availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same local network, LAN segment, or VPN as the target device; remote exploitation over the open internet is not possible without prior network access.

• AuthenticationRequired

  A low-privilege account on the Web FastCGI Service is sufficient; the endpoint does not require administrator credentials.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends a crafted request directly to the vulnerable endpoint.

• Attack complexityDetail

  The exploit is reliable and condition-free once network and credential requirements are met; no race conditions or specific memory-layout dependencies are noted in the CVSS vector.

Blast Radius

• Reads all data accessible to the FastCGI service process, including stored credentials, configuration, and session material on the phone.
• Overwrites memory and modifies persisted configuration or runtime state on the device.
• Crashes the Web FastCGI Service, rendering the phone's web management interface and associated API endpoints unavailable.
• A compromised device could serve as a foothold for further lateral movement within the local network segment it occupies.