VulnSocial

CVE-2026-12220Disclosure

LOWCVSS 7.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-119CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-06-15); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-15: 1Mentions · 2026-07-04: 1Technical Details · 2026-06-15: 1Technical Details · 2026-07-04: 106-1507-04
Signal classification1 categories
Disclosure
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Joey Romaine 🇺🇸 |=★=|@Tank23x0
    Disclosure

    Another reminder that trust is earned, not assumed. CVE-2026-12220. A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePart... Build like the next disruption is already in motion — because it is.

    Post summary

    The post references CVE‑2026‑12220 targeting the Yealink SIP‑T46U’s mod_upgrade.SparePart function, providing some technical details but no evidence of active exploitation, a PoC, or a patch.

    0000040
    339 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-12220 Stack-Based Buffer Overflow in Yealink SIP-T46U Firmware Chunk Upload Handler https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12220

    Post summary

    The text announces a stack-based buffer overflow vulnerability (CVE‑2026‑12220) in Yealink SIP‑T46U firmware, providing technical details but no exploitation, patch, or PoC information.

    0000043
    4.0K followersView on X

Explore more

Back to dashboard