CVE-2026-12219

A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start of the component Web FastCGI Service. This manipulation of the argument Time causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 108.87.0.23 is sufficient to resolve this issue. It is advisable to upgrade the affected component.

• CWE-74
• CWE-77

• https://cdn2.v50to.cc/T46U/T46U_mod_diagnose_CommandShellByType_iperf_time_cmd_injection.zip
• https://vuldb.com/cve/CVE-2026-12219
• https://vuldb.com/submit/834204
• https://vuldb.com/vuln/370862
• https://vuldb.com/vuln/370862/cti

Published

Jun 15, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-122179Heap-based buffer overflow in Windows Internet Connection Sh…7
• CVE-2026-12218A vulnerability was detected in Yealink SIP-T46U 108.87.50.1…8
• CVE-2026-122182Improper link resolution before file access ('link following…7
• CVE-2026-122183Out-of-bounds read in Windows Kernel allows an authorized at…7.8
• CVE-2026-122188A flaw has been found in DeepGraphLearning KnowledgeGraphEmb…6.3
• CVE-2026-122189A vulnerability has been found in OpenPPL ppl.nn up to bb84d…6.3
• CVE-2026-122190A vulnerability was found in SourceCodester Online Food Orde…2.4
• CVE-2026-122191A vulnerability was determined in itsourcecode Airline Reser…6.3
• CVE-2026-122192Improper handling of a failed memory remap in Firecracker ve…7.5
• CVE-2026-122193OS command injection in the example SSM document provisionin…9.9
• CVE-2026-122194Null pointer dereference in Microsoft Defender allows an una…8.8
• CVE-2026-122196Improper restriction of xml external entity reference in Mic…6.5