CVE-2026-12211 Overview
CVE-2026-12211 is a path traversal vulnerability affecting the Intelbras iNVU 7016 FT network video recorder running firmware version 3.004.00IB000.0.T Build 2025-09-26. The flaw resides in an unspecified function handling requests to the /RPC2_Loadfile/syslog/ endpoint of the device Web Interface. An authenticated remote attacker with high privileges can manipulate request parameters to traverse outside the intended directory and read files on the device file system. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A public exploit writeup has been released, and Intelbras has shipped a fixed firmware build.
Critical Impact
Authenticated attackers can read arbitrary files from the Intelbras iNVU 7016 FT device over the network, exposing configuration data and credentials stored on the embedded file system.
Affected Products
- Intelbras iNVU 7016 FT
- Firmware version 3.004.00IB000.0.T Build 2025-09-26
- Web Interface component handling /RPC2_Loadfile/syslog/
Discovery Timeline
- 2026-06-15 - CVE-2026-12211 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-12211
Vulnerability Analysis
The vulnerability stems from improper sanitization of user-controlled input passed to a file-loading routine exposed by the Web Interface. The /RPC2_Loadfile/syslog/ endpoint accepts a parameter that is concatenated into a filesystem path without normalization. Attackers can inject directory traversal sequences such as ../ to escape the intended syslog directory and request arbitrary files from the embedded Linux file system.
Exploitation requires network reachability to the device Web Interface and valid high-privileged credentials. Once a path traversal request is accepted, the server returns the file contents in the HTTP response. Targets of interest on embedded recorders include /etc/passwd, /etc/shadow, configuration databases, and stored RTSP or ONVIF credentials.
Because the affected component is the management interface of a network video recorder, successful exploitation can support reconnaissance against connected IP cameras and downstream surveillance infrastructure. A public writeup describing the local file inclusion behavior is available on the researcher Coaglio LFI Writeup.
Root Cause
The root cause is missing canonicalization and validation of a path component supplied to the RPC2_Loadfile handler. The handler trusts the syslog sub-path argument and resolves it relative to the filesystem without rejecting traversal sequences or enforcing a directory allowlist.
Attack Vector
The attack is launched remotely over the network against the device HTTP management interface. The attacker authenticates with a high-privileged account, issues a crafted GET or POST request to /RPC2_Loadfile/syslog/ containing traversal characters, and receives the contents of the targeted file. No user interaction is required.
No verified exploit code is reproduced here. Refer to the VulDB CVE-2026-12211 record and the linked researcher writeup for technical details.
Detection Methods for CVE-2026-12211
Indicators of Compromise
- HTTP requests to /RPC2_Loadfile/syslog/ containing ../, ..%2f, or URL-encoded traversal sequences.
- Web Interface access log entries returning non-syslog file contents or unusually large response bodies for the RPC2_Loadfile endpoint.
- Authenticated administrative sessions originating from unexpected source IP addresses immediately preceding traversal requests.
Detection Strategies
- Inspect HTTP traffic to the iNVU 7016 FT management interface for traversal patterns targeting the RPC2_Loadfile path.
- Alert on repeated 200-OK responses to /RPC2_Loadfile/syslog/ requests where the URI contains .. sequences or encoded variants.
- Correlate administrative logins with subsequent file-read activity to identify abuse of legitimate credentials.
Monitoring Recommendations
- Forward NVR Web Interface access logs to a centralized logging platform for retention and search.
- Track outbound HTTP responses from the device for sensitive file signatures such as root:x: or known configuration markers.
- Monitor administrative account usage on embedded devices and flag logins from non-management network segments.
How to Mitigate CVE-2026-12211
Immediate Actions Required
- Upgrade affected Intelbras iNVU 7016 FT devices to the firmware build released by the vendor on the Intelbras Firmware Download portal.
- Restrict access to the device Web Interface to a dedicated management VLAN and trusted administrator workstations.
- Rotate administrator credentials on devices that may have been exposed prior to patching.
Patch Information
Intelbras released a fixed firmware build dated 2026-05-29 for the iNVU 7016 FT product line. Operators should verify their current firmware version against the patched release and apply the update through the standard administrative workflow. Confirmation of the fix is tracked in the VulDB Vulnerability #370853 record.
Workarounds
- Block external access to the device HTTP and HTTPS management ports at the perimeter firewall.
- Place NVR appliances behind a VPN or jump host so the Web Interface is not reachable from untrusted networks.
- Disable or limit high-privileged accounts to the minimum number of operators required for administration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
