This vulnerability affects Yealink SIP-T46U firmware version 108.87.50.1. The StartReportInformation function in the Web FastCGI Service improperly handles the port argument, leading to a stack-based buffer overflow. An attacker with local network access can exploit this flaw to potentially execute arbitrary code or cause a denial of service. The CVSS 4.0 base score is 8.6, reflecting high impact with low attack complexity but requiring local access and privileges. No official fix or vendor advisory has been published, and the exploit is publicly available.

Successful exploitation can lead to arbitrary code execution or denial of service on the affected device. The vulnerability requires local network access and some privileges, limiting remote exploitation. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability of the device.

No official patch or remediation is currently available from the vendor. Since the exploit requires local network access, restricting network access to the device and isolating it from untrusted networks may reduce risk. Monitor for updates from Yealink for any forthcoming patches or advisories. Avoid exposing the device to untrusted local networks until a fix is released.