This vulnerability affects Yealink SIP-T46U version 108.86.0.118 in the mod_webd.BlueToothTest function within the /api/inner/bttest endpoint of the Web FastCGI Service. By manipulating the btMac, pin, or reserved parameters, an attacker with local network access can cause a stack-based buffer overflow. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 4.0 base score is 8.6, indicating high severity with attack vector requiring local access and low attack complexity.

Successful exploitation can lead to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service on the affected device. The attack requires local network access, limiting remote exploitation. No known exploits are currently reported in the wild.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should restrict local network access to the affected device and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.