Skip to main content
Mallory
HighPublic exploit

Stack-based Buffer Overflow in Yealink SIP-T46U Web FastCGI Service BlueToothTest

IdentifiersCVE-2026-12222CWE-121· Stack-based Buffer Overflow

CVE-2026-12222 affects Yealink SIP-T46U firmware version 108.86.0.118. The vulnerability is in the Web FastCGI Service, specifically the mod_webd.BlueToothTest function exposed via the /api/inner/bttest endpoint. A crafted manipulation of the btMac, pin, or reserved argument can trigger a stack-based buffer overflow, indicating insufficient bounds checking on attacker-controlled input before copying it into a stack buffer. The issue is reachable over the device web interface from within the local network. Public disclosure indicates exploit details are available.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can corrupt stack memory in the vulnerable FastCGI process, which may result in process crash and denial of service. Depending on exploitability characteristics such as stack protections, memory layout, and control over overwritten data, the vulnerability could potentially enable arbitrary code execution in the context of the affected web service. At minimum, it provides a memory corruption primitive against the device management interface from a local-network position.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the phone's web management interface to trusted administrative hosts only using network segmentation, ACLs, and management VLAN isolation. Disable or limit web administration if operationally feasible. Prevent untrusted devices from reaching the local management plane, and monitor for requests to /api/inner/bttest or anomalous interactions with Bluetooth test functionality. If possible, place affected phones behind dedicated voice-network controls and block lateral access from general user subnets.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed firmware release if and when Yealink publishes one for the SIP-T46U. If no patch is available, monitor vendor advisories and apply updated firmware immediately upon release. Because the vulnerable component is the web management FastCGI service handling /api/inner/bttest, remediation should prioritize eliminating exposure of that interface to untrusted local-network users and retiring affected firmware version 108.86.0.118 where possible.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7

Community discussion across Reddit, Mastodon, and other social sources.