CVE-2026-6074: Intrado 911 Gateway Path Traversal Flaw

CVE-2026-6074 Overview

A path traversal vulnerability has been identified in the Intrado 911 Emergency Gateway (EGW) that could allow an attacker with existing network access to bypass authentication and access the EGW management interface. This critical vulnerability enables unauthorized users to read, modify, or delete files on affected systems, posing a severe risk to emergency communication infrastructure.

Critical Impact

This path traversal vulnerability allows unauthenticated attackers to access the 911 Emergency Gateway management interface, potentially compromising critical emergency services infrastructure through file manipulation.

Affected Products

• Intrado 911 Emergency Gateway (EGW)

Discovery Timeline

• 2026-04-23 - CVE-2026-6074 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-6074

Vulnerability Analysis

This vulnerability is classified under CWE-35 (Path Traversal: '.../...//'). The flaw exists within the Intrado 911 Emergency Gateway's web management interface, where insufficient input validation allows attackers to manipulate file path parameters. By crafting malicious requests containing path traversal sequences, an attacker can escape the intended directory structure and access arbitrary files on the system.

The vulnerability is particularly concerning given the critical nature of 911 emergency services infrastructure. Successful exploitation does not require authentication, meaning any attacker with network access to the EGW management interface can potentially compromise the system. The impact includes the ability to read sensitive configuration files, modify system settings, or delete critical files that could disrupt emergency communication services.

Root Cause

The root cause of this vulnerability is improper input validation within the EGW management interface. The application fails to adequately sanitize user-supplied input containing directory traversal sequences such as ../ or encoded variants. This allows attackers to construct file paths that reference locations outside the web application's intended directory scope, bypassing normal access restrictions.

Attack Vector

The attack is network-based and can be executed without authentication. An attacker with network access to the EGW management interface can send specially crafted HTTP requests containing path traversal sequences. These malicious requests manipulate file path parameters to access files outside the authorized directory structure.

A typical attack scenario involves:

1. The attacker identifies a network-accessible Intrado 911 EGW management interface
2. The attacker crafts HTTP requests with path traversal sequences in URL parameters or request bodies
3. The vulnerable application processes the malicious input without proper sanitization
4. The attacker gains access to read, modify, or delete arbitrary files on the system

For detailed technical information about this vulnerability, refer to the CISA ICS Advisory ICSA-26-113-06.

Detection Methods for CVE-2026-6074

Indicators of Compromise

• HTTP requests to the EGW management interface containing path traversal sequences such as ../, ..%2f, ..%5c, or similar encoded variants
• Unusual file access patterns in system logs indicating attempts to read configuration files or sensitive data
• Unexpected modifications to system files or configurations on the EGW appliance
• Authentication-related log entries showing access to administrative functions without valid credentials

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns
• Monitor HTTP access logs for requests with directory traversal sequences in URLs, query parameters, or POST data
• Deploy intrusion detection systems (IDS) with signatures for path traversal attack patterns targeting the EGW management interface
• Implement file integrity monitoring on critical EGW system files to detect unauthorized modifications

Monitoring Recommendations

• Enable verbose logging on the EGW management interface and forward logs to a centralized SIEM
• Configure alerts for any access attempts to the management interface from unauthorized network segments
• Monitor for unusual patterns of file read/write operations on the EGW system
• Implement network traffic analysis to detect anomalous HTTP requests targeting the management interface

How to Mitigate CVE-2026-6074

Immediate Actions Required

• Restrict network access to the EGW management interface to only authorized IP addresses and network segments
• Implement network segmentation to isolate the 911 Emergency Gateway from general network traffic
• Deploy a web application firewall (WAF) with rules to block path traversal attempts
• Review system logs for any evidence of exploitation attempts and investigate accordingly

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-113-06 for official patch information and remediation guidance from Intrado. Contact Intrado support directly to obtain the latest security updates for the 911 Emergency Gateway.

Workarounds

• Implement strict network access controls to limit connectivity to the EGW management interface to trusted administrative hosts only
• Deploy reverse proxy with input validation capabilities in front of the management interface
• Enable authentication at the network level (e.g., VPN) before allowing access to the management interface
• Monitor and log all access to the management interface for forensic purposes until a patch can be applied

# Example firewall configuration to restrict management interface access
# Restrict EGW management interface to specific admin network
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Log all connection attempts for monitoring
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "EGW-MGMT-ACCESS: "