CVE-2026-12218 | Yealink SIP-T46U 108.87.50.1 Web FastCGI Service beforewifitest StartReportInformation port stack-based overflow

A vulnerability classified as . The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow.

This vulnerability is known as CVE-2026-12218. Access to the local network is required for this attack. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure and is working on a patch to fix it.