CVE-2025-13221

Executive Summary

CVE-2025-13221 exposes a critical credential storage vulnerability in Intelbras UnniTI version 24.07.11. The flaw resides in the /xml/sistema/usuarios.xml file, where user credentials (Usuario and Senha) are stored in plaintext or with weak obfuscation. An unauthenticated remote attacker can retrieve this file, gaining immediate access to all stored usernames and passwords. Public exploit code has been released, increasing the risk of mass exploitation. No patch is currently available from Intelbras.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device management system.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full credential disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High) – Confidentiality impact is severe, and the attack is trivial to execute.

Deep Dive & Mechanics

The vulnerability is a classic case of insecure credential storage. The file /xml/sistema/usuarios.xml is served by the web interface without authentication. Analysis of the public exploit shows the file contains XML entries like:

<usuario>
    <login>admin</login>
    <senha>plaintext_password</senha>
</usuario>

The Senha field may be base64-encoded or stored in plaintext, but in either case, it is trivially reversible. The web server does not restrict access to this file, allowing any unauthenticated HTTP request to retrieve it.

Root Cause: The application fails to enforce access controls on sensitive configuration files and does not hash or encrypt stored passwords.

Vulnerable vs. Patched Code

Vulnerable (Intelbras UnniTI 24.07.11): The file /xml/sistema/usuarios.xml is accessible without authentication and contains credentials in plaintext or weak encoding.

Patched (Hypothetical): A patched version would:

• Restrict access to /xml/sistema/usuarios.xml via authentication and authorization checks.
• Store passwords using a strong hashing algorithm (e.g., bcrypt, Argon2).
• Remove the file from the web root or serve it only through an authenticated API endpoint.

No official patch exists as of this report.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Intelbras UnniTI 24.07.11.
• Network access to the device's web interface (typically port 80 or 443).

Exploitation Steps:

1. Send an HTTP GET request to the vulnerable file:

   curl http://<target_ip>/xml/sistema/usuarios.xml
   

2. Parse the XML response to extract all <login> and <senha> elements.
3. If passwords are base64-encoded, decode them:

   echo "cGFzc3dvcmQ=" | base64 -d
   

4. Use the harvested credentials to log into the device's administrative interface.

Example Output:

<usuarios>
    <usuario>
        <login>admin</login>
        <senha>YWRtaW4xMjM=</senha>
    </usuario>
</usuarios>

Decoded: admin123

Blue Team (Defense & Detection)

Immediate Actions:

• Isolate affected devices from untrusted networks.
• Implement network-level access controls (e.g., firewall rules) to restrict access to the web interface.
• Monitor for unauthorized access to /xml/sistema/usuarios.xml.

Long-Term Mitigation:

• Contact Intelbras for a firmware update.
• If no patch is available, consider replacing the device or implementing a reverse proxy with authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /xml/sistema/usuarios.xml from external IPs.
  • Unusual traffic to port 80/443 on Intelbras devices.
• File IOCs:
  • Presence of /xml/sistema/usuarios.xml on the web server.
• Behavioral IOCs:
  • Multiple failed login attempts followed by successful authentication using harvested credentials.

Detection Engineering

YARA Rule

rule CVE_2025_13221_Credential_Leak {
    meta:
        description = "Detects attempts to access Intelbras UnniTI credential file"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13221"
    strings:
        $xml_header = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
        $usuarios_tag = "<usuarios>"
        $senha_tag = "<senha>"
    condition:
        $xml_header at 0 and $usuarios_tag and $senha_tag
}

Sigma Rule

title: CVE-2025-13221 Intelbras UnniTI Credential Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to the vulnerable /xml/sistema/usuarios.xml file
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/xml/sistema/usuarios.xml'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13221 Intelbras UnniTI Credential Leak Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/xml/sistema/usuarios.xml"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Restrict network access to the device's web interface using firewall rules.
2. Change all default passwords immediately.
3. Monitor logs for unauthorized access to /xml/sistema/usuarios.xml.

Long-Term:

1. Contact Intelbras support for a firmware patch.
2. If no patch is available, consider replacing the device with a secure alternative.
3. Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable path.

Workaround:

• If the device cannot be replaced, place it behind a reverse proxy that requires authentication before forwarding requests to the backend.

Valters IT
Securing Digital Frontiers