A vulnerability was found in CyberData 011209 SIP Emergency Intercom and classified as very critical. This issue affects an unknown function of the component File Upload. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-35. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.

The advisory is shared at cisa.gov. The identification of this vulnerability is CVE-2025-30515. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/10/2025). MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 22.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17590). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• IP Phone Software

Vendor

• CyberData

Name

• 011209 SIP Emergency Intercom

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion