An attacker can manipulate the ip/port parameter in the mod_webd.TFTPUploadIperf endpoint of Yealink’s Web FastCGI Service to inject and execute arbitrary shell commands on the device. This flaw enables the execution of malicious code when accessed over the internal network, compromising the confidentiality, integrity, and availability of the device and any network resources controlled by it. The weakness maps to CWE-74 and CWE-77, highlighting improper handling of user-supplied input and insufficient validation of command arguments.

Yealink SIP-T46U, firmware version 108.86.0.118. The vulnerability is specific to the Web FastCGI Service component and the TFTPUploadIperf API endpoint on this model.

The CVSS score of 5.1 reflects a moderate severity, yet the flaw is exploitable from within the local network and an exploit is publicly available. With no EPSS value or KEV designation, the current data does not indicate a high probability of widespread exploitation, but the local nature of the attack vector means that compromised or malicious internal users can readily trigger it. The lack of a KEV listing suggests that mass exploitation is not yet observed.