CVE-2025-13221: Intelbras UnniTI Credential Disclosure Flaw

CVE-2025-13221 Overview

CVE-2025-13221 is a credential storage weakness in Intelbras UnniTI version 24.07.11. The flaw resides in the handling of the /xml/sistema/usuarios.xml file, where the Usuario and Senha parameters are stored without adequate protection. A remote unauthenticated attacker can retrieve administrator credentials by accessing the exposed XML resource over the network. The issue is categorized under [CWE-255] (Credentials Management Errors) and stems from the application exposing plaintext credential data through a web-accessible path. Public exploitation details have been released, increasing the likelihood of opportunistic abuse against internet-exposed devices.

Critical Impact
Remote unauthenticated attackers can retrieve plaintext administrator credentials from Intelbras UnniTI 24.07.11 by requesting an exposed XML file, enabling full device takeover.

Affected Products

Intelbras UnniTI 24.07.11
Affected file: /xml/sistema/usuarios.xml
Impacted parameters: Usuario and Senha

Discovery Timeline

2025-11-15 - CVE-2025-13221 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13221

Vulnerability Analysis

The vulnerability affects the credential storage mechanism inside Intelbras UnniTI 24.07.11. The application persists administrative usernames and passwords in the file /xml/sistema/usuarios.xml. This XML resource is reachable over the network without authentication. An attacker who requests the file receives the Usuario and Senha values in a readable form. The weakness is classified as [CWE-255], covering credentials management errors such as unprotected storage. Because credentials are exposed to any network-adjacent client, exploitation does not require user interaction or privileges. Public analysis of the issue has been published on VulDB and third-party research notes, and a proof-of-concept is publicly referenced. The EPSS probability at time of writing is 0.351%.

Root Cause

The root cause is unprotected storage of credentials. The usuarios.xml file is written to a directory served by the web interface without access controls or encryption of the credential fields. Credentials are treated as configuration data rather than secrets, so no hashing, encryption, or authentication gate is applied when the file is served.

Attack Vector

The attack vector is remote and network-based. An attacker sends an HTTP request to the vulnerable path /xml/sistema/usuarios.xml on a reachable UnniTI device. The device returns the XML document containing the Usuario and Senha values. The retrieved credentials can then be reused to authenticate against the management interface and pivot within the network. No verified exploit code is included here; refer to the Notion Analysis on Intelbras Credentials and VulDB #332537 entries for reproduction details.

Detection Methods for CVE-2025-13221

Indicators of Compromise

HTTP GET requests to /xml/sistema/usuarios.xml originating from external or untrusted IP addresses.
Successful administrative logins to UnniTI devices from IP addresses that previously requested the XML path.
Presence of the usuarios.xml file in web server access logs with 200 response codes to unauthenticated sessions.

Detection Strategies

Inspect web server and reverse proxy logs for direct requests to /xml/sistema/, particularly usuarios.xml.
Correlate credential file access events with subsequent authentication attempts to the UnniTI management console.
Alert on any unauthenticated retrieval of XML configuration resources from Intelbras UnniTI hosts.

Monitoring Recommendations

Deploy network intrusion detection signatures matching the vulnerable URI pattern on segments that host UnniTI devices.
Continuously monitor administrative account usage for logins from unfamiliar sources following exposure of the device to the internet.
Track configuration file access from management interfaces and treat repeated XML resource enumeration as suspicious.

How to Mitigate CVE-2025-13221

Immediate Actions Required

Remove Intelbras UnniTI 24.07.11 management interfaces from direct internet exposure and restrict access to trusted management VLANs.
Rotate all administrator credentials stored on affected devices, assuming prior disclosure.
Review web server logs for historical access to /xml/sistema/usuarios.xml and treat any hits as credential compromise events.

Patch Information

No vendor patch is referenced in the available advisories at the time of publication. Consult VulDB #332537 - CTI and Intelbras support channels for updated firmware releases addressing the credential storage weakness.

Workarounds

Block external requests to /xml/sistema/usuarios.xml at the perimeter firewall, WAF, or reverse proxy layer.
Enforce IP allowlists on the UnniTI management interface so only administrative subnets can reach the web service.
Where feasible, place the device behind a VPN and disable public HTTP/HTTPS access until a vendor fix is applied.

bash

# Configuration example: block access to the vulnerable path at an nginx reverse proxy
location ~* ^/xml/sistema/ {
    deny all;
    return 403;
}