Intelbras TIP 125i CVE-2026-101265

Exploitation targets the web management interface of the Intelbras TIP 125i VoIP phone (firmware 4.3.35/4.3.41), specifically an unspecified function of the 'Básico' configuration page that embeds sensitive information in the page source. Per the CVSS 4.0 vector, exploitation requires network reachability to the device's web UI (AV:N) plus low-level privileges (PR:L) - so an account or session on the interface - and is rated high-complexity (AC:H) with the vendor explicitly calling exploitability 'difficult.' No user interaction is required (UI:N). Limiting factors: attackers must reach the phone's management interface (typically on an internal/management VLAN, not the public internet), must hold at least low-privilege access, and must satisfy the difficult, high-complexity conditions; impact is confined to a limited confidentiality leak (VC:L) with no integrity or availability effect.

This is a low-priority issue by every available signal. The vendor (VulDB, via cna@vuldb.com) assigned a CVSS 4.0 base score of just 1.3, and the vector CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N reflects that: while remotely reachable (AV:N), it requires high attack complexity (AC:H) - VulDB explicitly describes exploitability as 'difficult' - some level of privilege (PR:L), and yields only a low confidentiality impact (VC:L) with no integrity or availability impact. The only impact is inclusion of sensitive information in the page source code (CWE-200), i.e. a minor information leak. On the exploitation-status axis, there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation; the E:P (Proof-of-Concept) temporal metric and VulDB's note that 'the exploit is publicly available and might be used' indicate publicly available exploit code exists but not that it is being used in the wild. Signals are internally consistent - there is no CVSS-vs-description conflict here - but note the CVSS 4.0 vector is the only quantitative signal; no NVD-native score, EPSS, or SSVC decision points were supplied. Net assessment: a real but very low-severity information-disclosure flaw in a niche device, not a genuine priority.

An attacker with low-level access to the phone's web management interface repeatedly requests the 'Básico' configuration page and inspects the returned HTML source, where sensitive information is embedded in the page code. Public proof-of-concept exploit code exists (VulDB E:P), but the vendor rates exploitation as difficult (AC:H), so success requires specific conditions and effort. The disclosed data offers only limited confidentiality impact and no direct code execution or takeover.