Command Injection Vulnerability in Yealink SIP-T46U Web FastCGI Service

CVE-2026-12219

What is CVE-2026-12219?

A vulnerability exists in Yealink's SIP-T46U, particularly within the Web FastCGI Service handling commands. The flaw arises in the function mod_diagnose.CommandShellByType located in the /api/diagnosis/start file, where an argument manipulation in the Time parameter can lead to command injection. This security weakness can be remotely exploited, allowing an attacker to execute arbitrary commands. Despite earlier notifications regarding this flaw, the vendor has not provided a response.

References