Intelbras Telefone IP TIP 200 and TIP 200 LITE expose a vulnerability that allows unauthenticated remote attackers to read any file on the device through the dumpConfigFile function accessed via the cgiServer.exx endpoint. This directly results in loss of confidentiality for configuration files and credentials such as /etc/shadow. The weakness is a classic absolute path traversal (CWE‑73).

The affected products are Intelbras Telefone IP TIP 200 and Intelbras Telefone IP TIP 200 LITE. No specific firmware or model version information is provided, so the flaw is presumed to exist across the reported variants of these devices.

The base CVSS score of 8.7 indicates high severity. An EPSS score of less than 1% suggests that exploitation has been uncommon, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit the issue by sending a simple GET request to /cgi-bin/cgiServer.exx with the command parameter set to dumpConfigFile(), requiring only network reachability to the device and no authentication.