CVE-2026-101265 in TIP 125i
Summary
by MITRE • 09/29/2026
A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within the Intelbras TIP 125i network video recorder, specifically affecting firmware versions 4.3.35 through 4.3.41, represents a significant information exposure risk rooted in the implementation of the Basic Page component. This flaw is categorized as an improper restriction of operations within the bounds of a memory buffer or data structure, leading to the unintended disclosure of sensitive internal details via the web interface source code. The core technical issue lies in how the server handles requests directed at specific functions within this basic page module. Instead of sanitizing output or restricting access based on user privilege levels, the application inadvertently exposes raw source code that contains hardcoded credentials, API keys, database connection strings, or other internal configuration parameters. This behavior aligns with CWE-200, which defines exposure of sensitive information to an unauthorized actor, and more specifically reflects aspects of CWE-614 concerning session side channel issues if authentication tokens are leaked, though the primary vector here is direct source code leakage rather than a traditional injection attack.
From an operational perspective, this vulnerability allows for remote exploitation without requiring prior authentication on many configurations, or it may require minimal interaction depending on how the Basic Page is exposed in the specific deployment scenario. The description notes that while the exploitability is considered difficult and of high complexity, meaning there are likely prerequisites such as specific request formatting or timing constraints, the fact that a public exploit exists significantly lowers the barrier to entry for attackers. Once an attacker successfully leverages this flaw, they can retrieve sensitive information embedded in the source code. This data often includes administrative passwords, database credentials, or internal network topology details which can be used to facilitate further attacks such as privilege escalation, lateral movement within the local network, or targeted phishing campaigns against administrators who may have their credentials exposed.
The presence of a publicly available exploit transforms this theoretical vulnerability into an immediate threat for any organization running unpatched versions of the TIP 125i firmware. Attackers can utilize automated scanning tools to identify vulnerable devices on the internet and execute the provided scripts to dump sensitive data from the web server response. This is particularly dangerous in surveillance environments where security cameras are often deployed with default or weak credentials, making the leakage of additional administrative details a critical risk multiplier. The high complexity rating suggests that while not trivially exploitable by script kiddies without understanding the underlying mechanics, it remains accessible to determined adversaries who have access to public exploit repositories and possess basic web application testing skills.
Mitigation strategies must prioritize immediate firmware updates provided by Intelbras for all devices running versions 4.3.35 through 4.3.41. If updating is not immediately feasible due to operational constraints, network segmentation should be implemented to restrict access to the management interface of these devices from untrusted networks such as the public internet. Access control lists on firewalls and routers can limit inbound traffic to only known administrative IP addresses, thereby reducing the attack surface significantly. Additionally, organizations should audit their current deployments for any signs of compromise by monitoring logs for unusual outbound data transfers or unexpected access patterns related to web server requests. Regular vulnerability assessments that include active scanning against these specific firmware versions are recommended to ensure compliance with security baselines and adherence to industry standards like NIST SP 800-53 which mandates the protection of information system components from unauthorized disclosure.