A path‑traversal flaw was identified in the Web Interface of Intelbras iNVU 7016 FT, specifically within the /RPC2_Loadfile/syslog/ routine. The vulnerability allows an attacker to manipulate the requested path and access files located outside the intended directory, potentially exposing log data or other sensitive files on the device. The weakness is a classic instance of CWE‑22 and results in unauthorized data disclosure without requiring local access.

The affected product is Intelbras iNVU 7016 FT running firmware version 3.004.00IB000.0.T Build 2025‑09‑26. No other versions are listed, but the component should be considered vulnerable on any build lacking the vendor’s fix.

The CVSS score of 5.1 indicates moderate severity, and the vulnerability can be exploited remotely. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, yet the exploit has been published and may be used in the wild. Because path traversal only grants read access, the impact is limited to information disclosure, but it can compromise device integrity if sensitive configuration files are accessible. Applying the vendor’s patch mitigates the risk; absence of a patch signals that users should isolate the device or restrict web interface access to trusted sources.