CVE-2026-101265: Intelbras TIP 125i Information Disclosure

CVE-2026-101265 Overview

CVE-2026-101265 is an information disclosure vulnerability in the Intelbras TIP 125i IP phone, affecting firmware versions 4.3.35 and 4.3.41. The flaw resides in an unspecified function of the Básico page component, which embeds sensitive information directly in the HTML source code returned to clients. An authenticated remote attacker with low privileges can retrieve this data by inspecting the page source. The issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. The vendor was contacted before public disclosure, and a proof of concept has been made publicly available.

Critical Impact
Remote low-privileged users can extract sensitive configuration data embedded in the Básico page source, aiding follow-on attacks against the device.

Affected Products

Intelbras TIP 125i firmware version 4.3.35
Intelbras TIP 125i firmware version 4.3.41
Component: Básico Page (web management interface)

Discovery Timeline

2026-09-29 - CVE-2026-101265 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-101265

Vulnerability Analysis

The Intelbras TIP 125i is a VoIP desk phone with a web-based administration interface. The Básico (Basic) configuration page renders content that includes sensitive information within the HTML source returned to the browser. Because the data is placed inline in the source rather than filtered server-side, any client that can load the page can extract it by viewing the source or intercepting the HTTP response.

The attack requires network reachability to the phone's web interface and low-level authenticated access. According to the advisory, exploitability is described as difficult and the overall attack complexity is high, which limits practical use in most deployments. However, the exploit is publicly available, which raises the residual risk for exposed devices.

Root Cause

The root cause is improper output filtering in the Básico page handler. Sensitive values that should remain server-side, or be masked before rendering, are instead emitted verbatim into the response body. This maps to [CWE-200] and reflects a design decision that trusts the client to display fields without exposing their underlying content.

Attack Vector

An attacker with valid low-privilege credentials issues an HTTP request to the Básico page over the network. The server returns the page containing embedded sensitive information in the HTML source. The attacker parses the response body to extract the exposed values. No user interaction is required beyond the authenticated request. Refer to the VulDB entry for CVE-2026-101265 and the VulDB vulnerability record #411033 for additional technical context.

Detection Methods for CVE-2026-101265

Indicators of Compromise

Unexpected authenticated HTTP GET requests targeting the Básico configuration page of the TIP 125i web interface.
Repeated requests from a single source retrieving administrative pages outside of normal maintenance windows.
Web-server access logs showing scripted user-agent strings enumerating configuration endpoints.

Detection Strategies

Inspect HTTP responses from the phone's management interface for sensitive fields rendered in plaintext HTML.
Correlate authentication events with subsequent access to configuration pages to spot credential misuse.
Alert on access to the management UI from network segments that should not communicate with VoIP devices.

Monitoring Recommendations

Enable and centralize web-interface access logs from the affected phones.
Monitor for unusual outbound scraping patterns against the management IP range of VoIP infrastructure.
Track firmware versions across the fleet to identify devices still running 4.3.35 or 4.3.41.

How to Mitigate CVE-2026-101265

Immediate Actions Required

Restrict access to the TIP 125i web management interface to a dedicated management VLAN.
Enforce strong, unique credentials for all administrative and low-privilege accounts on the device.
Audit existing accounts and remove any low-privilege users that are no longer required.
Review recent access to the Básico page and rotate any credentials or secrets that may have been exposed.

Patch Information

No vendor patch is listed in the referenced advisory sources at the time of publication. Monitor the VulDB entry for CVE-2026-101265 and Intelbras vendor channels for firmware updates addressing the Básico page information exposure.

Workarounds

Block inbound access to the phone's HTTP/HTTPS management ports from untrusted networks using ACLs or firewall rules.
Disable the web management interface when it is not actively required for provisioning or troubleshooting.
Segment VoIP devices from user workstations to reduce the pool of hosts that can reach the management page.

bash

# Example: restrict management access to the TIP 125i using an upstream firewall rule
# Replace the interface, phone IP, and management subnet with values for your environment
iptables -A FORWARD -p tcp -d 192.0.2.25 --dport 80  -s 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.25 --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.25 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.25 --dport 443 -j DROP