Description
A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Karel | Karel IP Phone IP1211 | — | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Karel IP Phone IP1211 Web Management Panel - Local File Inclusion http/cves/2025/CVE-2025-34023.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://web.archive.org/web/20201020023943/https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon product
- https://cxsecurity.com/issue/WLB-2020100038 third-party-advisory exploit
- https://www.exploit-db.com/exploits/48857 third-party-advisory exploit