Vulnerability Description
A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Related Weaknesses (CWE)
References
- https://cxsecurity.com/issue/WLB-2020100038
- https://vulncheck.com/advisories/selea-targa-ip-camera-path-traversal
- https://web.archive.org/web/20201020023943/https://www.karel.com.tr/urun-cozum/i
- https://www.exploit-db.com/exploits/48857
FAQ
What is CVE-2025-34023?
CVE-2025-34023 is a documented vulnerability. A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing rem...
How severe is CVE-2025-34023?
CVSS scoring is not yet available for CVE-2025-34023. Check NVD for updates.
Is there a patch for CVE-2025-34023?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.