EUVD-2025-18777CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Lifecycle Timeline
4Description
A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Analysis
CVE-2025-34023 is a path traversal vulnerability in Karel IP1211 IP Phone's web management panel that allows remote authenticated attackers to read arbitrary files from the underlying system via unsanitized input to the /cgi-bin/cgiServer.exx endpoint's page parameter. This vulnerability affects IP phone administrators with network access to the management interface and carries a CVSS 8.5 score reflecting high confidentiality impact. Active exploitation evidence was documented by Shadowserver Foundation on 2025-02-02 UTC, indicating real-world attack activity.
Technical Context
The vulnerability exists in the Karel IP1211 IP Phone's CGI-based web management interface, specifically in the cgiServer.exx endpoint. The vulnerability stems from improper input validation of the 'page' parameter, allowing path traversal sequences (e.g., ../, ..\ or encoded variants) to bypass directory restrictions and traverse the filesystem. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability where user-supplied input is used directly in file access operations without proper canonicalization or validation. The IP1211 is a VoIP/IP telephony device that runs embedded Linux or similar firmware; the cgiServer.exx is a C++ CGI application handling HTTP requests to the management web interface typically running on port 80 or 8080. The lack of input sanitization means attackers can construct payloads like '../../etc/passwd' or URL-encoded variants to read sensitive configuration files, credential stores, or system files containing passwords, SSH keys, or network topology information.
Affected Products
Affected Product: Karel IP1211 IP Phone. Specific component: Web management panel (/cgi-bin/cgiServer.exx endpoint). CPE approximation: cpe:2.3:h:karel:ip1211:-:*:*:*:*:*:*:* (hardware device; firmware versions not specified in CVE description but likely multiple firmware builds are affected given the CGI endpoint vulnerability). Vendor: Karel Electronics (Czech VoIP equipment manufacturer). No specific patched version numbers are provided in the CVE description; vendor advisory details are not included in the provided data. All versions of Karel IP1211 with web management functionality should be considered at risk unless vendor patches are applied.
Remediation
Immediate actions: (1) Restrict network access to the Karel IP1211 web management interface—implement firewall rules to limit access to administrative IP ranges only; (2) Change default credentials if not already done; enforce strong, unique administrator passwords; (3) Disable web management access if not required, preferring physical management or VPN-based access. Patch remediation: Contact Karel Electronics directly for firmware updates addressing CVE-2025-34023. Check the vendor's security advisory portal for patches (typical URLs: support.karel.cz or similar). If patches are available, schedule firmware updates following the vendor's procedures (usually requiring device reboot). Workarounds pending patches: (1) Implement Web Application Firewall (WAF) rules to block requests containing '../', '..\', or URL-encoded variants (%2e%2e%2f) in the 'page' parameter; (2) Deploy network segmentation to isolate IP phone management interfaces; (3) Monitor access logs for suspicious path traversal attempts. Long-term: Upgrade to Karel IP phone models with more recent firmware or alternative vendors with demonstrated secure development practices.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today