Home

Description

A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

PUBLISHED Reserved 2025-04-15 | Published 2025-06-20 | Updated 2026-04-07 | Assigner VulnCheck




HIGH: 8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version
unknown

Credits

Berat Gokberk Isler finder

References

web.archive.org/...karel.com.tr/urun-cozum/ip1211-ip-telefon product

cxsecurity.com/issue/WLB-2020100038 third-party-advisory exploit

www.exploit-db.com/exploits/48857 third-party-advisory exploit

vulncheck.com/...sories/selea-targa-ip-camera-path-traversal third-party-advisory

cve.org (CVE-2025-34023)

nvd.nist.gov (CVE-2025-34023)

Download JSON