CVE-2019-25472
Unauthenticated Arbitrary File Read in IntelBras TIP200 IP Phones
Publication date: 2026-03-11
Last updated on: 2026-03-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intelbras | telefone_ip_tip200 | * |
| intelbras | telefone_ip_tip200_lite | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability affects IntelBras Telefone IP TIP200 and 200 LITE devices. It is an unauthenticated arbitrary file read flaw in the dumpConfigFile function accessible via the cgiServer.exx endpoint. Attackers can send specially crafted GET requests to the device's /cgi-bin/cgiServer.exx endpoint with a command parameter invoking dumpConfigFile() to read sensitive files on the device without any authentication."}, {'type': 'paragraph', 'content': 'The vulnerability allows reading of critical files such as /etc/shadow, which contains hashed passwords, and various configuration files. This means an attacker can remotely access sensitive information stored on the device without needing any credentials or prior authorization.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have serious impacts because it allows an attacker to remotely read sensitive files on the affected device without authentication. Exposure of files like /etc/shadow can reveal hashed passwords for critical users such as root, admin, and guest.
With access to these sensitive files, an attacker could potentially escalate privileges, gain unauthorized control over the device, or use the information to compromise other parts of the network. The confidentiality of sensitive configuration and credential data is compromised, increasing the risk of further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending HTTP GET requests to the vulnerable device's CGI endpoint to check if arbitrary files can be read without authentication."}, {'type': 'paragraph', 'content': 'A typical detection command involves requesting the /cgi-bin/cgiServer.exx endpoint with the command parameter set to dumpConfigFile() targeting sensitive files such as /etc/shadow.'}, {'type': 'paragraph', 'content': 'For example, you can use curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -k "http://<target-ip>/cgi-bin/cgiServer.exx?command=dumpConfigFile(%22/etc/shadow%22)"'}, {'type': 'paragraph', 'content': 'If the response contains the contents of the requested file (e.g., /etc/shadow), the device is vulnerable.'}, {'type': 'paragraph', 'content': 'Additionally, the exploit described in Resource 1 uses a Perl script that automates this process by sending crafted HTTP requests and analyzing the responses.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
I don't know