CVE-2025-30515: CyberData Intercom File Upload Vulnerability

CVE-2025-30515 Overview

CVE-2025-30515 affects the CyberData 011209 SIP Emergency Intercom, an IP-based communication device used in industrial and emergency response environments. The vulnerability allows an authenticated attacker to upload arbitrary files to multiple locations within the device file system. The flaw maps to CWE-35: Path Traversal, indicating insufficient validation of file path components during upload operations. CISA published the issue under ICS Advisory ICSA-25-155-01, classifying it as a critical industrial control system risk. Successful exploitation can compromise device integrity, availability, and confidentiality.

Critical Impact
An authenticated attacker can write arbitrary files to sensitive locations on the intercom, enabling persistent code execution and full device compromise.

Affected Products

CyberData 011209 SIP Emergency Intercom (hardware)
CyberData 011209 SIP Emergency Intercom Firmware (all versions prior to vendor fix)
Deployments referenced under CISA ICS Advisory ICSA-25-155-01

Discovery Timeline

2025-06-09 - CVE-2025-30515 published to the National Vulnerability Database
2025-06-09 - CISA released ICS Advisory ICSA-25-155-01
2025-08-12 - Last updated in the NVD database

Technical Details for CVE-2025-30515

Vulnerability Analysis

The CyberData 011209 SIP Emergency Intercom exposes a web-based administration interface for configuration, audio file management, and firmware updates. The upload handlers fail to canonicalize and restrict destination paths supplied by authenticated users. As a result, an attacker with valid credentials can place files outside the intended upload directory. Because the device runs an embedded Linux environment, writing to startup scripts, configuration directories, or web root locations leads to persistent compromise. The Common Weakness Enumeration mapping [CWE-35] confirms the root cause is improper handling of path traversal sequences in file destination parameters.

Root Cause

The upload functionality does not validate or normalize traversal sequences such as ../ before writing files to disk. The intercom firmware trusts user-supplied path components and combines them with privileged write operations performed by the web service. Authentication is required, but no additional authorization or filesystem sandboxing protects sensitive paths.

Attack Vector

The vulnerability is exploitable over the network. An attacker who obtains valid administrative or operator credentials, including through default or weak credentials common in IoT deployments, can craft an HTTP request to the upload endpoint. The request body includes a manipulated filename or path parameter containing traversal characters. The intercom writes the attacker-controlled file to a sensitive location such as a system binary directory, cron job path, or web-accessible script directory, enabling code execution on the device.

No public proof-of-concept or exploit code is available at the time of writing. Refer to CISA ICS Advisory ICSA-25-155-01 for vendor-coordinated technical details.

Detection Methods for CVE-2025-30515

Indicators of Compromise

HTTP POST requests to the intercom administrative interface containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in filename or path parameters.
Unexpected files appearing in system directories such as /etc/, /usr/bin/, /www/, or startup script locations on the device.
Outbound network connections initiated by the intercom to unfamiliar hosts following an upload event.
Configuration changes or new audio prompts that were not authorized by the device owner.

Detection Strategies

Inspect web server and reverse proxy logs in front of the intercom for upload requests containing traversal characters or unusual destination paths.
Monitor authentication logs for successful logins from unexpected source IP addresses, especially outside operational hours.
Baseline the intercom firmware filesystem and alert on integrity changes to system directories using scheduled comparisons.

Monitoring Recommendations

Route intercom management traffic through a segmented OT network with full packet capture for forensic review.
Forward device syslog output to a centralized SIEM or data lake and create alerts for upload activity outside change windows.
Track CISA advisory updates and CyberData firmware release notes for indicators tied to this CVE.

How to Mitigate CVE-2025-30515

Immediate Actions Required

Restrict network access to the intercom administrative interface to a dedicated management VLAN or jump host.
Rotate all administrative and operator credentials on affected devices and disable any default accounts.
Audit existing intercom filesystems and configurations for unauthorized files, scripts, or scheduled tasks.
Apply firmware updates from CyberData as soon as a patched version becomes available.

Patch Information

CyberData coordinated disclosure with CISA under ICS Advisory ICSA-25-155-01. Administrators should consult the advisory and the vendor support portal for the specific firmware version that remediates CVE-2025-30515. Verify the firmware hash against the vendor-published value before applying.

Workarounds

Block inbound HTTP and HTTPS traffic to the intercom from untrusted networks using a firewall ACL.
Place the intercom behind a reverse proxy that strips traversal sequences and enforces strict request validation.
Disable remote administration features that are not required for emergency operation.
Enforce multi-factor authentication on any jump host or VPN used to reach the device management interface.

bash

# Example firewall rule restricting intercom management access to a single admin host
iptables -A INPUT -p tcp -s 10.10.20.5 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP