A flaw arises from an unprotected functionality in the /OutsideCmd file on Intelbras VIP 3260 Z IA. By manipulating this endpoint, an attacker can trigger the password recovery process and obtain an easily guessable or reset password, revealing the credentials of privileged users. The weakness, categorized as CWE‑640, allows the recovery logic to be forced without proper authentication. As a result, the confidentiality of user accounts is compromised and an attacker could gain full control over the device.

Intelbras VIP 3260 Z IA, firmware version 2.840.00IB005.0.T is vulnerable. No other versions are known to be affected.

The vulnerability has a CVSS score of 9.2, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. The attack vector is remote; an adversary would need to expose the /OutsideCmd endpoint, craft a payload that triggers the weak recovery routine, and then obtain the reset password. While the exploitation pathway is complex, the high impact of credential compromise warrants prompt action.