CVE-2019-25472

IntelBras Telefone IP TIP200/200 LITE Arbitrary File Read via dumpConfigFile

Published Mar 11, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

IntelBras Telefone IP TIP200 and 200 LITE contain an unauthenticated arbitrary file read vulnerability in the dumpConfigFile function accessible via the cgiServer.exx endpoint. Attackers can send GET requests to /cgi-bin/cgiServer.exx with the command parameter containing dumpConfigFile() to read sensitive files including /etc/shadow and configuration files without proper authorization.

Analysis

Technical impact

Intelbras Telefone IP TIP 200 and TIP 200 LITE expose a vulnerability that allows unauthenticated remote attackers to read any file on the device through the dumpConfigFile function accessed via the cgiServer.exx endpoint. This directly results in loss of confidentiality for configuration files and credentials such as /etc/shadow. The weakness is a classic absolute path traversal (CWE‑73).

Affected Systems

The affected products are Intelbras Telefone IP TIP 200 and Intelbras Telefone IP TIP 200 LITE. No specific firmware or model version information is provided, so the flaw is presumed to exist across the reported variants of these devices.

Risk and Exploitability

The base CVSS score of 8.7 indicates high severity. An EPSS score of less than 1% suggests that exploitation has been uncommon, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit the issue by sending a simple GET request to /cgi-bin/cgiServer.exx with the command parameter set to dumpConfigFile(), requiring only network reachability to the device and no authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Intelbras

Telefone IP TIP 200

unaffected

Version	Status	Constraints
`*`	affected	—

Intelbras

Telefone IP TIP 200 LITE

unaffected

Version	Status	Constraints
`*`	affected	—

No data.

Vendor Product Versions

Intelbras

Telefone Ip Tip 200

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Intelbras

Telefone Ip Tip 200 Lite

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check the Intelbras website or customer portal for an official firmware update or patch that addresses CVE-2019-25472
Apply the identified patch or firmware upgrade to the affected Telefone IP TIP 200 or 200 LITE devices

Generated by OpenCVE AI on March 17, 2026 at 15:07 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.343% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://backend.intelbras.com/sites/default/files/integration/lamina_tip-200-lite_e_tip-200.pdf
https://www.exploit-db.com/exploits/47337
https://www.vulncheck.com/advisories/intelbras-telefone-ip-tip200-200-lite-arbitrary-file-read-via-dumpconfigfile

History

Mar 12, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Intelbras Intelbras telefone Ip Tip 200 Intelbras telefone Ip Tip 200 Lite
Vendors & Products		Intelbras Intelbras telefone Ip Tip 200 Intelbras telefone Ip Tip 200 Lite

Mar 11, 2026 10:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://www.vulncheck.com/advisories/intelbras-telefone-ip-tip-lite-arbitrary-file-read-via-dumpconfigfile

Mar 11, 2026 10:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.vulncheck.com/advisories/intelbras-telefone-ip-tip200-200-lite-arbitrary-file-read-via-dumpconfigfile

Mar 11, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 11, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IntelBras Telefone IP TIP200 and 200 LITE contain an unauthenticated arbitrary file read vulnerability in the dumpConfigFile function accessible via the cgiServer.exx endpoint. Attackers can send GET requests to /cgi-bin/cgiServer.exx with the command parameter containing dumpConfigFile() to read sensitive files including /etc/shadow and configuration files without proper authorization.
Title		IntelBras Telefone IP TIP200/200 LITE Arbitrary File Read via dumpConfigFile
Weaknesses		CWE-73
References		https://backend.intelbras.com/sites/default/files/integration/lamina_tip-200-lite_e_tip-200.pdf https://www.exploit-db.com/exploits/47337 https://www.vulncheck.com/advisories/intelbras-telefone-ip-tip-lite-arbitrary-file-read-via-dumpconfigfile
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`