CVE-2026-12219

MEDIUM

Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection

Title source: cna
STIX 2.1

Description

A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start of the component Web FastCGI Service. This manipulation of the argument Time causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 108.87.0.23 is sufficient to resolve this issue. It is advisable to upgrade the affected component.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-370862 | Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection
https://vuldb.com/vuln/370862
Signature, Permissions Required signature permissions-required
VDB-370862 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/370862/cti
Third Party Advisory third-party-advisory
CVE-2026-12219 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-12219
Third Party Advisory third-party-advisory
Submit #834204 | yealink T46U 108.86.0.118 Command Injection
https://vuldb.com/submit/834204

Scores

CVSS v3 6.3
EPSS 0.0105
EPSS Percentile 60.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (2)
Yealink/SIP-T46U 108.86.0.118
Yealink/SIP-T46U 108.87.0.23
Published Jun 15, 2026
Tracked Since Jun 15, 2026