Command Injection Vulnerability in Yealink SIP-T46U Devices

CVE-2026-12223

What is CVE-2026-12223?

A command injection vulnerability has been discovered in the Yealink SIP-T46U device's Web FastCGI Service, specifically within the mod_webd.TFTPUploadIperf function. This flaw allows an attacker within the local network to manipulate input parameters (such as ip/port) and execute arbitrary commands. The exploit is publicly available, which poses a significant risk to vulnerable installations. Despite early warnings, Yealink's response to address this issue has been lacking, leaving devices susceptible to potential exploitation.

References