EUVD-2026-84397
GHSA-9524-7567-6c47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed KarelIPS endpoint
-
DeliverySend crafted parameter with blind SQL payload
-
ExploitInfer DB responses via boolean/time delay
-
ExecutionAutomate extraction of credentials and data
-
ImpactExfiltrate sensitive database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a KarelIPS instance's vulnerable input (per AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special configuration is needed against a default deployment). The principal limiting factors are: (1) the product is niche and vendor-declared unsupported, so exposure is confined to remaining KarelIPS installations, ideally not internet-facing; (2) the injection is BLIND, so meaningful data extraction requires automated inference (boolean/time-based) rather than direct output, increasing time and detectability; and (3) achieving the claimed integrity/availability impact (I:H/A:H) presumes the DB user has write/stacked-query privileges, which is deployment-dependent and unconfirmed. |
| Impact | The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes an unauthenticated, network-reachable, low-complexity blind SQL injection with full CIA impact - the classic profile of a high-priority remote flaw. However, several corroborating exploitation signals are entirely absent from the intelligence set: there is no EPSS probability, no CISA KEV listing, no SSVC decision data, and no public exploit code referenced. Exploitation status is therefore 'no public exploit identified at time of analysis.' Two factors temper the raw 9.8: (1) it is a BLIND injection, so data extraction is inference-based (boolean/time-based) and slower/noisier than in-band SQLi, and full I:H/A:H likely assume stacked-query or DBA-level DB privileges that the description does not confirm; (2) the vendor has stated the product is END-OF-LIFE / unsupported, meaning no patch will be issued - this simultaneously raises long-term risk (permanent exposure for any remaining deployments) and lowers aggregate real-world risk (declining install base). Net: a genuinely severe vulnerability class for any internet-exposed KarelIPS instance, but the lack of exploitation telemetry and the niche, unsupported product footprint argue for prioritization scoped to organizations that actually run KarelIPS, rather than broad emergency response. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted input to a vulnerable KarelIPS web/API parameter, using boolean- or time-based blind SQL injection to infer database contents character-by-character (e.g., extracting administrator credentials or subscriber/call data). Because CVSS is AV:N/AC:L/PR:N, no authentication or user interaction is needed, though the blind nature makes exfiltration slower and typically requires automation (e.g., sqlmap). No public proof-of-concept exploit is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Blind SQL injection in KarelIPS, the IP/PBX-adjacent product from Karel Electronic Industry and Trade Inc., allows unauthenticated remote attackers who can reach the product's network-exposed input to inject SQL and infer database contents through boolean- or time-based responses. All versions through 22092026 are affected, and the vendor-contacted via TR-CERT-has stated the product is no longer supported, so no vendor fix is expected; no public exploit code has been identified at time of analysis, and the blind nature of the injection makes data extraction slow and inference-driven rather than immediate. The advisory claims CVSS 9.8 (C:H/I:H/A:H), but the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, High) reflects the more likely case: certain high-impact confidentiality loss, with integrity and availability effects contingent on the privileges of the underlying database account and therefore deployment-dependent.
RemediationAI
No vendor-released patch identified at time of analysis: Karel contacted the TR-CERT reporter and stated the product is unsupported, so there is no fixed version to upgrade to and remediation must be architectural (reference: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1146). Prioritize removing network exposure: place KarelIPS on an isolated management VLAN reachable only from trusted administrative hosts, and if it is currently internet-facing, take it off the public internet immediately-an expected side effect is that remote endpoints or softphone clients that depend on the device's exposed services may lose connectivity and will need to be re-homed behind a VPN. Require admin access through a VPN or bastion with source-IP allowlisting; the trade-off is added friction and a single point of failure for administration. Deploy WAF/IPS signatures for SQL injection (boolean- and time-based patterns, e.g., long SLEEP/WAITFOR delays) in front of any remaining exposed interface, accepting that signature-based filtering is bypassable and generates false positives on legitimate long-running queries. Reduce blast radius at the database layer by ensuring the application's DB account has read-only or otherwise least privileges and no stacked-query or file-write rights, which directly counters the claimed I:H/A:H scenario; validate that no application functionality depends on elevated DB privileges before applying. Because exploitation is blind, enable query logging and alert on anomalous request timing or repeated conditional queries, and plan migration off the unsupported platform since no future fix should be expected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command: user-controlled input reaches a SQL query without parameterization or escaping, so an attacker can alter query logic. Because the flaw is blind, the application does not return query results or error output directly to the attacker, and exploitation therefore relies on crafted boolean conditions or time-delay payloads (e.g., conditional sleep) to leak data one bit or one inference at a time. Per the assessed vector the attack is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction (UI:N), against default deployments; the CVSS submission in the advisory asserts full integrity and availability impact, but the independent assessment downgrades to I:L/A:N because write or stacked-query capability depends on the database permissions granted to the web application, which is not confirmed. The only affected identifier is the catch-all CPE cpe:2.3:a:karel_electronic_industry_and_trade_inc.:karelips:*:*:*:*:*:*:*:* (vendor wildcard, all versions), reported by TR-CERT with CISA-style tracking tags 'SQLi' and 'Karelips'. The primary practical constraints on exploitation are that KarelIPS is a niche product with a shrinking install base and that blind inference is noisy and slow, increasing the chance of detection by time-based anomalous request patterns.
Know when Karelips gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network blind SQLi cleanly reads DB data (C:H); integrity is limited/conditional on write privileges (I:L) and availability impact is not substantiated by the blind-read description (A:N).
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection.
This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is not supported.
Executive ViewAI
KarelIPS, a legacy IP/PBX-adjacent product from Karel Electronic Industry and Trade Inc., is affected by a critical blind SQL injection vulnerability (CVE-2026-12718) that unauthenticated attackers can exploit remotely to extract sensitive data from its database. No vendor-released patch identified at time of analysis, as the vendor has declared end-of-support, leaving organizations that still operate this product exposed to potential data breaches. Leadership should prioritize identifying and isolating affected systems to prevent unauthorized access to confidential information.
Restrict network access to the KarelIPS interface to trusted IP ranges; implement a web application firewall with SQL injection detection and blocking rules; enforce least privilege on database accounts; enable detailed logging and monitoring for anomalous database queries; consider virtual patching if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB