CVE-2025-26468 Overview
CVE-2025-26468 affects the CyberData 011209 SIP Emergency Intercom, an IP-based communication device used in safety and emergency notification systems. The vulnerability stems from exposed features that lack authentication controls [CWE-306]. An unauthenticated remote attacker can reach these features over the network and trigger a denial-of-service condition or disrupt device operation. The flaw carries a CVSS 4.0 score of 8.7 and is documented in CISA ICS Advisory ICSA-25-155-01. Because emergency intercoms support life-safety functions, disruption of the device can degrade incident response capabilities in critical environments.
Critical Impact
Unauthenticated remote attackers can disrupt CyberData 011209 SIP Emergency Intercom operations, impairing emergency communication availability.
Affected Products
- CyberData 011209 SIP Emergency Intercom (hardware)
- CyberData 011209 SIP Emergency Intercom firmware (all versions prior to vendor fix)
- Deployments referenced under cpe:2.3:o:cyberdata:011209_sip_emergency_intercom and cpe:2.3:h:cyberdata:011209_sip_emergency_intercom
Discovery Timeline
- 2025-06-09 - CVE-2025-26468 published to NVD
- 2025-06-20 - Last updated in NVD database
- ICSA-25-155-01 - CISA publishes ICS advisory for the vulnerability
Technical Details for CVE-2025-26468
Vulnerability Analysis
The CyberData 011209 SIP Emergency Intercom exposes functionality over the network without enforcing authentication. The weakness is categorized under [CWE-306] (Missing Authentication for Critical Function). An attacker on the same network segment, or one able to route traffic to the device, can interact with these exposed features directly. The result is a loss of availability for the affected intercom, which can manifest as service interruption, unresponsive call handling, or unexpected restarts. Confidentiality and integrity remain unaffected per the CVSS vector, but availability impact is rated high.
Root Cause
The device exposes administrative or operational functions that should require authentication but accept requests from any network client. Missing authentication checks on these endpoints allow direct invocation by remote actors without credentials.
Attack Vector
Exploitation requires network access to the intercom and no privileges or user interaction. An attacker sends crafted requests to the exposed feature, causing the device to enter a denial-of-service state or experience operational disruption. Devices deployed on flat networks, exposed to untrusted VLANs, or reachable through misconfigured firewalls are at greatest risk.
No public proof-of-concept exploit has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.253%.
Detection Methods for CVE-2025-26468
Indicators of Compromise
- Unexpected reboots, crashes, or unresponsive states on CyberData 011209 intercoms
- Unauthenticated HTTP or SIP requests to intercom management interfaces from unfamiliar source addresses
- Spikes in inbound traffic to intercom IP addresses on management or signaling ports
Detection Strategies
- Inventory all CyberData 011209 SIP Emergency Intercoms and map their network exposure
- Capture and review network flows to and from intercom devices for anomalous request patterns
- Alert on repeated failed or malformed SIP and HTTP requests targeting intercom endpoints
Monitoring Recommendations
- Monitor device uptime and SIP registration status to identify availability disruptions early
- Log syslog output from intercoms to a centralized SIEM and alert on restart or error events
- Track ARP and DHCP activity to detect rogue clients attempting to reach intercom subnets
How to Mitigate CVE-2025-26468
Immediate Actions Required
- Identify all CyberData 011209 SIP Emergency Intercoms in the environment and confirm firmware version
- Restrict network access to intercom management and SIP interfaces using ACLs or firewall rules
- Place intercoms on isolated VLANs reachable only by authorized SIP servers and management hosts
- Review CISA ICS Advisory ICSA-25-155-01 for vendor guidance
Patch Information
CyberData has not published a fixed firmware version within the data referenced here. Consult CyberData product support and the CISA ICS Advisory ICSA-25-155-01 for the latest remediation and firmware release information.
Workarounds
- Segment intercom devices onto dedicated VLANs with strict ingress filtering
- Block external and untrusted internal access to intercom HTTP and SIP service ports
- Require VPN or jump-host access for any administrative interaction with the device
- Disable any unused services or exposed features on the intercom where the device permits configuration
# Example firewall ruleset restricting access to intercom subnet 10.20.30.0/24
# Allow SIP traffic only from the authorized PBX
iptables -A FORWARD -s 10.10.10.5 -d 10.20.30.0/24 -p udp --dport 5060 -j ACCEPT
# Allow management only from the admin jump host
iptables -A FORWARD -s 10.10.20.10 -d 10.20.30.0/24 -p tcp --dport 443 -j ACCEPT
# Drop all other traffic to intercom subnet
iptables -A FORWARD -d 10.20.30.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
