This vulnerability affects Yealink SIP-T46U version 108.86.0.118. It involves a command injection flaw in the mod_diagnose.CommandShellByType function of the /api/diagnosis/start API endpoint in the Web FastCGI Service. By manipulating the Time parameter, an attacker can remotely execute arbitrary commands on the device. The vendor was contacted but did not provide any response or patch. No official remediation or patch has been published as of the disclosure date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected Yealink SIP-T46U device, potentially compromising the device's integrity and availability. The impact on confidentiality, integrity, and availability is rated as low to limited according to the CVSS vector. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to the disclosure, users should consider mitigating exposure by restricting network access to the affected device, especially to the /api/diagnosis/start endpoint. Monitor for unusual activity and consider isolating affected devices until a vendor fix is released. Check the vendor advisory regularly for updates regarding patches or official mitigations.