CVE-2020-24285
📋 TL;DR
This vulnerability in INTELBRAS TELEFONE IP TIP200 allows attackers to access sensitive information through the /cgi-bin/cgiServer.exx endpoint without authentication. It affects users of this specific VoIP phone model running vulnerable firmware. The exposed information could include credentials, configuration data, or other system details.
💻 Affected Systems
- INTELBRAS TELEFONE IP TIP200
📦 What is this software?
Tip200 Firmware by Intelbras
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain administrative credentials, compromise the entire VoIP system, conduct eavesdropping, or pivot to other network resources.
Likely Case
Attackers harvest sensitive configuration data, user credentials, or call records from vulnerable devices.
If Mitigated
Information exposure limited to non-critical data if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Simple HTTP request to the vulnerable endpoint can expose information. GitHub repository contains details and potentially exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://intelbras.com
Restart Required: No
Instructions:
1. Check Intelbras website for firmware updates. 2. If update available, download from vendor portal. 3. Upload firmware to device via web interface. 4. Apply update and verify version change.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to device web interface
iptables -A INPUT -p tcp --dport 80 -s ! TRUSTED_NETWORK -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! TRUSTED_NETWORK -j DROP
Disable Web Interface
allTurn off HTTP/HTTPS services if not required
Check device configuration for web interface toggle
🧯 If You Can't Patch
- Segment VoIP devices on isolated network VLAN
- Implement strict firewall rules allowing only necessary SIP/RTP traffic
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP GET request to http://DEVICE_IP/cgi-bin/cgiServer.exx and check if sensitive information is returnedCheck Version:
Check device web interface or use SNMP query for firmware versionVerify Fix Applied:
Same request should return error or no sensitive data after patching📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /cgi-bin/cgiServer.exx
- Unusual access patterns to device web interface
Network Indicators:
- HTTP requests to /cgi-bin/cgiServer.exx from untrusted sources
- Large data transfers from device on unusual ports
SIEM Query:
source_ip=* AND dest_ip=VOIP_DEVICE AND url_path="/cgi-bin/cgiServer.exx"