CVE-2026-101265

Executive Summary

CVE-2026-101265 is an information disclosure vulnerability (CWE-200) affecting the Intelbras TIP 125i IP phone running firmware versions 4.3.35 and 4.3.41. The flaw resides in an unspecified function of the "Básico" (Basic) configuration page, where sensitive information is improperly embedded within the source code returned to a client. Per the NVD description, the vulnerability is remotely reachable but requires a high attack complexity, and successful exploitation yields only limited confidentiality impact (CVSS 3.1 base score 3.1). A public exploit exists and the vendor was notified, but no patch has been released as of this report.

Technical Analysis

The NVD description states that "the affected element is an unknown function of the component Básico Page" and that "such manipulation leads to inclusion of sensitive information in source code." This maps directly to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically the sub-pattern of sensitive data being rendered into client-visible page source rather than being protected server-side.

Because the vulnerable component is the "Básico" administrative/configuration page of the TIP 125i web interface, the exposure occurs when that page is served. The sensitive information is embedded directly into the HTML/JavaScript returned to the browsing client — a common weak design where credentials, tokens, internal configuration values, or device secrets are pushed to the front end instead of being kept on the server. The description does not name the exact data field, function, or endpoint, so the precise secret type cannot be confirmed from the available data.

Attack characteristics:

• Attack vector (AV:N): The flaw is reachable over the network via the device's web management interface.
• Attack complexity (AC:H): High — exploitation is described as "difficult" and "exploitability is described as difficult," implying preconditions such as authentication, specific page interaction, or parsing of the returned source.
• Privileges required (PR:L): Low — some low-privileged access or authentication state is needed to reach the "Básico" page.
• User interaction (UI:N): None required on a victim user's part.
• Scope/Impact: Unchanged scope; confidentiality impact Low (C:L); no integrity or availability impact (I:N/A:N).

No specific function names, file paths, HTTP parameters, or endpoints are disclosed in the NVD entry, and no CNA title was provided. Hardening assessment beyond the class-level mechanism is not supportable from the available data.

Exploitation Scenarios

No public PoC was provided in the data set, though the NVD entry states "the exploit is publicly available and might be used." The attack chain below is therefore described strictly at the vulnerability-class level.

1. Reconnaissance / target identification. An attacker identifies internet- or network-exposed Intelbras TIP 125i devices, typically via discovery of the web management interface. Because the flaw is in the "Básico" page, the attacker must locate a device whose firmware is 4.3.35 or 4.3.41 and reach that page.

2. Triggering the flaw class. With low-privileged access sufficient to load the "Básico" configuration page, the attacker requests that page. The vulnerability class (sensitive information in source code) is triggered by the server embedding sensitive data into the HTML/script returned to the client instead of withholding it. No crafted malicious input necessarily required — the act of rendering the page reveals the data.

3. Payload / execution method. There is no code-execution payload. The "attack" consists of retrieving and inspecting the page source (e.g., reading the raw HTTP response body) to recover the sensitive information that has been inlined. The high complexity (AC:H) reflects that reaching a state where the page discloses the secret may require additional conditions.

4. Post-exploitation impact. The recovered sensitive information (confidentiality-only, C:L) can be used to further an attacker's knowledge of the device or environment. There is no stated integrity or availability impact, so the flaw is an enabler for follow-on reconnaissance or credential/secret harvesting rather than direct compromise.

Impact Assessment

The immediate impact is limited: CVSS 3.1 base score 3.1 with confidentiality impact only at the "Low" level and no integrity or availability impact. The high attack complexity and required low-level privileges keep the practical risk low for most environments. Business impact centers on potential exposure of device-related secrets that could aid lateral movement or further targeting. Blast radius is confined to Intelbras TIP 125i units running the two affected firmware versions; the device class (IP desk phone) is typically deployed at scale in enterprise voice environments, so even a low-severity information leak could aggregate across many endpoints if the same page is broadly reachable. Because affected versions are limited to 4.3.35 and 4.3.41 and no patch exists, exposure persists until compensating controls or firmware updates are available.

Detection Guidance

Sigma Rule

title: Intelbras TIP 125i Sensitive Information Disclosure via Basico Page
id: 7c1b9f2e-4a3d-4e11-9b0c-2f6a8d1e5c47
status: experimental
description: Detects HTTP access to the Intelbras TIP 125i "Básico" configuration page, which may disclose sensitive information in source code (CVE-2026-101265).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101265
author: valtersit.com
date: 2026-01-01
tags:
  - attack.collection
  - cve.2026-101265
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_path:
    cs-uri-stem|contains:
      - '/basico'
      - '/Básico'
      - '/basic'
  selection_ua:
    cs-user-agent|contains: 'Mozilla'
  condition: selection_method and selection_path
falsepositives:
  - Legitimate administrator access to device configuration
level: low

YARA Rule

rule CVE_2026_101265_Intelbras_TIP125i_InfoLeak
{
    meta:
        description = "Detects Intelbras TIP 125i web responses referencing the Basico configuration page potentially leaking sensitive info (CVE-2026-101265)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101265"
        date = "2026-01-01"
        severity = "low"

    strings:
        $vendor = "Intelbras" ascii nocase
        $model  = "TIP 125i" ascii nocase
        $page   = "B" ascii wide
        $cfg    = "basico" ascii nocase

    condition:
        uint16(0) != 0x0000 and filesize < 2MB and
        $vendor and $model and any of ($page, $cfg)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101265 Intelbras TIP 125i Basico Page Sensitive Info Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"basico"; nocase; http.user_agent; content:"Mozilla"; reference:cve,2026-101265; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101265; classtype:attempted-recon; sid:2026101265; rev:1;)

Elastic Detection

network where
  network.protocol == "http" and
  http.request.method == "GET" and
  (
    stringContains(http.request.uri, "basico", false) or
    stringContains(http.request.uri, "Básico", false)
  ) and
  network.direction == "inbound"

Splunk SPL Query

index=web OR index=proxy
| eval uri=lower(coalesce(uri, url, cs_uri_stem))
| where (match(uri, "basico") OR match(uri, "básico"))
    AND (method="GET" OR cs_method="GET")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as sources by dest_host, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,intelbras,cve-2026-101265,">
  <rule id="2026101265" level="4">
    <decoded_as>web-accesslog</decoded_as>
    <url>basico|básico</url>
    <method>GET</method>
    <description>CVE-2026-101265: Intelbras TIP 125i - access to Basico page, potential sensitive information disclosure in source code</description>
    <mitre>
      <id>T1592</id>
    </mitre>
    <group>recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or patch reference is currently available.

1. Immediate mitigations:

   • Restrict network access to the TIP 125i web management interface so only trusted administrative subnets can reach it (AC:H makes this a viable primary control).
   • Require authentication for the "Básico" page and ensure it is not accessible to unauthenticated or low-privileged clients beyond what is strictly necessary.
   • Segment IP phones onto a dedicated VLAN isolated from general corporate and internet-facing traffic.
   • Monitor HTTP access logs for requests to the "Básico" page from unexpected sources.

2. Patch / upgrade steps:

   • No patched firmware version has been identified. Track the Intelbras security advisory channel and apply the vendor fix as soon as it is released. Because the vendor was contacted early about the disclosure, monitor for an official statement or firmware update addressing versions 4.3.35 and 4.3.41.

3. Long-term hardening:

   • Establish a firmware vulnerability management process for VoIP/IP phone fleets so unpatched devices are tracked and isolated.
   • Disable or block the web management interface where it is not operationally required.
   • Apply least-privilege access to device configuration pages and enforce strong administrative credentials.

References

• NVD — CVE-2026-101265: https://nvd.nist.gov/vuln/detail/CVE-2026-101265
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1592 — Gather Victim Host Information: https://attack.mitre.org/techniques/T1592/
• FIRST EPSS — No score available at time of writing: https://www.first.org/epss/
• Intelbras security/advisory portal (vendor disclosure channel) — monitor for advisory covering TIP 125i firmware 4.3.35/4.3.41.

No CISA KEV listing exists for this CVE. No named threat actor campaign or confirmed exploit-in-the-wild evidence was provided in the source data; the NVD entry states the exploit is publicly available and "might be used."