CVE-2025-34023 Karel IP Phone IP1211 Path Traversal
Authenticated attackers can read arbitrary files on Karel IP1211 IP Phones via path traversal in the web management panel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34023?
CVE-2025-34023 is a high-severity path traversal vulnerability in Karel IP Phone IP1211, published on 20 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Weakness: CWE-22
Which versions are affected by CVE-2025-34023?
How do I fix CVE-2025-34023?
No fix has been published for CVE-2025-34023 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-34023 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34023 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-37m2-9j5v-c4v4.