Security Digest: June 15, 2026 - 10 Critical Vulnerabilities

Ten high-severity vulnerabilities demand immediate attention today, including multiple publicly disclosed, remotely exploitable issues in Yealink SIP-T46U, a command injection flaw in Ruijie EG105G-P, and a path traversal bug in Microweber. Several of the affected products have no vendor response yet, so teams should assume exploit attempts are likely and move quickly to patch, isolate, or disable exposed services.

2026-06-15 · 10 min read

Executive Summary

Ten high-severity vulnerabilities demand immediate attention today, including multiple publicly disclosed, remotely exploitable issues in Yealink SIP-T46U, a command injection flaw in Ruijie EG105G-P, and a path traversal bug in Microweber. Several of the affected products have no vendor response yet, so teams should assume exploit attempts are likely and move quickly to patch, isolate, or disable exposed services.

Prioritize internet-facing systems, local-network-only devices, and any host running affected printer drivers. If you cannot patch immediately, restrict access, remove exposure, and monitor for suspicious requests now.

Critical Vulnerabilities

CVE-2026-12192: GALAYOU Y4 web server buffer overflow

Impact: Attackers on the local network may trigger a buffer overflow and potentially crash or take control of the device. Public exploit code is already available.

Affected Systems: GALAYOU Y4 firmware 1.0.0, web server component.

Immediate Action: Remove the camera from any untrusted LAN segment, block management access, and assume compromise if the device is exposed to guests, contractors, or flat networks.

Mitigation: Apply a vendor fix if one appears; until then, isolate the device, change management credentials, and restrict access to trusted admin hosts only.

CVE-2026-12218: Yealink SIP-T46U FastCGI stack overflow via port parameter

Impact: A local-network attacker can trigger a stack-based buffer overflow through the web API and may gain code execution.

Affected Systems: Yealink SIP-T46U firmware 108.87.50.1, Web FastCGI Service.

Immediate Action: Block access to the phone’s web/API interface from all but admin workstations and remove the device from shared office VLANs if possible.

Mitigation: Update firmware when a fix is available; otherwise disable management interfaces not in use and segment voice devices tightly.

CVE-2026-12220: Yealink SIP-T46U firmware chunk upload overflow

Impact: A local attacker can exploit a stack overflow in the firmware upload handler and potentially execute code.

Affected Systems: Yealink SIP-T46U firmware 108.86.0.118, Firmware Chunk Upload handler.

Immediate Action: Disable firmware upload access from general user networks and verify that only trusted admins can reach the update endpoint.

Mitigation: Patch firmware as soon as a vendor release is available; if not, isolate affected phones and monitor for abnormal update traffic.

CVE-2026-12221: Yealink SIP-T46U upgrade endpoint overflow

Impact: Local-network attackers may exploit a stack-based buffer overflow in the upgrade path, risking device takeover.

Affected Systems: Yealink SIP-T46U firmware 108.86.0.118, /api/upgrade/upgrade.

Immediate Action: Restrict the upgrade interface to trusted admin IPs only and verify no external routing or VPN exposure exists.

Mitigation: Apply the vendor update when released; until then, reduce exposure and rotate administrative credentials.

CVE-2026-12222: Yealink SIP-T46U Bluetooth test overflow

Impact: A local attacker can abuse the Bluetooth test API to trigger a stack overflow and potentially run code on the phone.

Affected Systems: Yealink SIP-T46U firmware 108.86.0.118, Web FastCGI Service.

Immediate Action: Disable access to the device web interface from non-admin hosts and place affected phones on a dedicated, monitored network segment.

Mitigation: Patch when available; if Bluetooth features are unused, disable them and limit management access immediately.

CVE-2026-50100: Ricoh and KONICA MINOLTA printer drivers privilege escalation

Impact: A logged-in attacker on a Windows system can elevate privileges using a specially crafted driver.

Affected Systems: Multiple printer drivers from Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC.

Immediate Action: Identify endpoints using these drivers, remove unnecessary installations, and treat local user access as a path to admin compromise until patched.

Mitigation: Deploy the vendor-fixed driver package as soon as available and limit local logon rights on impacted systems.

CVE-2026-12198: Microweber API path traversal in thumbnail endpoint

Impact: Remote attackers may read files outside the intended path by manipulating the cache path parameter.

Affected Systems: Microweber up to 2.0.20, /api_nosession/thumbnail_img.

Immediate Action: Restrict public access to the API endpoint, review logs for unusual thumbnail requests, and assume sensitive file exposure may already have occurred.

Mitigation: Upgrade beyond 2.0.20 immediately; if patching is delayed, block the endpoint at the edge and validate file permissions.

CVE-2026-12204: ShopXO scheduled-task authorization bypass

Impact: Remote attackers can bypass authorization checks and invoke sensitive scheduled-task actions.

Affected Systems: ShopXO up to 6.7.1, app/api/controller/Crontab.php.

Immediate Action: Restrict access to the application, review scheduled-task activity for unauthorized jobs, and invalidate exposed admin sessions.

Mitigation: Apply the vendor fix when available; until then, place the app behind strong authentication and network controls.

CVE-2026-12200: TinyWeb Server header parsing overflow

Impact: Remote attackers may trigger a stack-based buffer overflow through the Authorization header and potentially execute code.

Affected Systems: Ritlabs TinyWeb Server up to 1.94 on Win32, libeeay32.dll.html header handler.

Immediate Action: Remove or isolate exposed TinyWeb instances and block inbound access until the server is updated or retired.

Mitigation: Upgrade to a fixed version if provided; otherwise disable the service and move web content to a supported platform.

CVE-2026-12197: Ruijie EG105G-P command injection in diagnose endpoint

Impact: Remote attackers can inject commands through the diagnose API and may fully compromise the device.

Affected Systems: Ruijie EG105G-P 2.340, /cgi-bin/luci/api/diagnose.

Immediate Action: Block remote access to the JSON-RPC diagnose endpoint immediately and check for unexpected outbound connections or configuration changes.

Mitigation: Apply a vendor patch as soon as it is released; until then, isolate the device and restrict management to a trusted admin network.

What to Do Now

Patch or isolate first: Prioritize Yealink, Ruijie, Microweber, ShopXO, TinyWeb, and affected printer-driver hosts.
Remove exposure: Block management interfaces, API endpoints, and upload features from all non-admin networks.
Assume public exploit attempts: Several flaws are already disclosed and may be in active use.
Check for compromise: Review logs, device configs, and admin activity for unusual access, uploads, or command execution.

Verification steps:

Inventory all systems running the listed products and versions.
Confirm whether any affected devices are reachable from guest, user, or internet-facing networks.
Validate firmware, driver, and application versions against vendor advisories.

Monitoring recommendations:

Watch for repeated requests to /api/inner/, /api/upgrade/, /cgi-bin/luci/api/diagnose, and /api_nosession/thumbnail_img.
Alert on unusual device reboots, config changes, new admin accounts, or outbound connections from phones, routers, and printers.
Increase scrutiny on local-network traffic; several of these attacks require only LAN access.

Related Resources

Internal blog posts: Refer to your organization’s internal guidance on emergency patching, network segmentation, and exposed device hardening.
Official vendor advisories: Monitor advisories from Yealink, Ruijie, Microweber, ShopXO, Ritlabs, Ricoh, and KONICA MINOLTA for fixed releases and deployment guidance.