EUVD-2025-17584

The vulnerability stems from CWE-288 (Authentication Bypass Using an Alternate Path or Channel), a root cause where security controls exist on primary paths but fail on alternate paths. CyberData 011209 intercoms expose a web management interface for configuration and control; the vulnerability likely involves an undocumented or improperly secured endpoint that bypasses standard authentication mechanisms. The intercom's web interface typically handles SIP configuration, audio settings, and network parameters—all sensitive functions. The alternate path may be a legacy endpoint, a debug interface, or an improperly segmented administrative function that inherited authentication from a parent component without validation. CVSS vector AV:N/AC:L indicates the flaw is exploitable over the network with no attack complexity, suggesting path traversal, parameter manipulation, or direct endpoint access rather than a sophisticated exploit.