The vulnerability is a stack-based buffer overflow caused by improper validation of the port argument in the StartReportInformation function of Yealink’s Web FastCGI Service. The overflow can enable an attacker to overwrite the return address and potentially execute arbitrary code, leading to remote code execution on the device. Because the flaw exists in a component exposed to the local network, the attacker needs local network access. The public availability of exploit code indicates the risk to a device on an unsecured local network is immediate.

Yealink SIP‑T46U 108.87.50.1 is affected. The specific component is the Web FastCGI Service, accessed via the /api/inner/beforewifittest endpoint.

The CVSS score of 8.6 classifies this vulnerability as high severity. EPSS is not available, so no current exploitation probability figure can be cited, but the public availability of exploit code indicates that exploitation is feasible. The vulnerability is not listed in KEV. Attack requires local network access to the SIP device; once accessed, the attacker can trigger the overflow by sending a crafted request to /api/inner/beforewifittest. Due to lack of a vendor patch or known workaround, organizations must rely on network controls to mitigate or monitor for exploitation attempts.