EUVD-2026-36685
GHSA-64mj-fhhf-6gmf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires high-privilege auth (PR:H); path traversal yields only partial file read (C:L), no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadfile/syslog/ of the component Web Interface. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Path traversal in the Intelbras iNVU 7016 FT NVR web interface allows authenticated high-privilege remote users to read arbitrary files outside the intended syslog directory via the /RPC2_Loadfile/syslog/ endpoint. Affected firmware is version 3.004.00IB000.0.T Build 2025-09-26; the vendor has since released a patched firmware build (2026-05-29). No public exploit identified at time of analysis as KEV-confirmed active exploitation, but a public proof-of-concept writeup exists, elevating practical risk above baseline.
Technical ContextAI
The Intelbras iNVU 7016 FT is a Brazilian-market Network Video Recorder (NVR), identified by CPE cpe:2.3:a:intelbras:invu_7016_ft:*:*:*:*:*:*:*:*. The vulnerable component is the device's embedded web management interface, specifically the /RPC2_Loadfile/syslog/ RPC endpoint, which is designed to serve syslog files to authenticated administrators. CWE-22 (Path Traversal) indicates the endpoint fails to sanitize or canonicalize user-supplied path components before resolving them on the filesystem, allowing directory escape sequences (e.g., '../') to reference files outside the intended syslog directory. The RPC2 naming convention is common in embedded device firmware (frequently ONVIF or Dahua-derivative stacks), where file-serving endpoints are exposed through authenticated API calls. The impact is limited to confidentiality (VC:L) with no write or denial-of-service capability surfaced by this endpoint.
RemediationAI
Vendor-released patch: firmware build INVU7016FT-2026.05.29 (binary available from the Intelbras CDN at http://api-cronos.intelbras.com.br/download/INVU/INVU7016FT/prod/INVU7016FT-2026.05.29-712953bf2bb2af7e72d0577ad5ef6455.260527.BIN). Administrators should apply this firmware update immediately via the device's web management interface. As a compensating control prior to patching, restrict access to the NVR's web management interface by placing it behind a VPN or firewall rule blocking direct internet exposure to the device's HTTP/HTTPS management ports - this eliminates the network attack vector entirely with no functional trade-off for legitimate remote management. Additionally, audit current admin-level accounts and rotate credentials, since exploitation requires high-privilege authentication; compromised credentials are the prerequisite for this attack. Do not expose NVR management interfaces directly to the internet as a general hardening posture. Additional context is available at https://vuldb.com/vuln/370853.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today