CyberData 011209 SIP Intercom five critical flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Five vulnerabilities in CyberData 011209 SIP Emergency Intercom before v22.0.1 allow unauthenticated remote code execution and credential theft.
CISA has published an advisory detailing five vulnerabilities affecting the CyberData 011209 SIP Emergency Intercom in versions prior to 22.0.1. These flaws span authentication bypass via alternate paths (CVE-2025-30184, CVSS 9.3), missing authentication on critical functions (CVE-2025-26468, CVSS 8.7), blind SQL injection for information disclosure (CVE-2025-30507, CVSS 6.9), insufficiently protected credentials storage (CVE-2025-30183, CVSS 8.7), and authenticated path traversal for arbitrary file upload (CVE-2025-30515, CVSS 9.3). The most critical issues allow unauthenticated attackers to achieve code execution, access the web interface without credentials, extract sensitive data, or cause denial of service. The device is deployed worldwide in communications, emergency services, and commercial facilities. No public exploitation has been reported at the time of publication. Vendor mitigation requires immediate upgrade to version 22.0.1. Organizations should prioritize patching and isolate affected devices from internet exposure and untrusted networks.
Mentioned in this report
Detection guidance
Web Path Traversal in POST/PUT Request to Embedded Device Web Interface
Detects POST/PUT requests whose URI or query carries directory traversal sequences, the pattern behind authenticated path-traversal arbitrary file upload on embedded web UIs such as SIP intercoms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Path Traversal in POST/PUT Request to Embedded Device Web Interface
description: Detects POST or PUT requests containing directory traversal sequences
(plain or URL-encoded) in the URI or query string. Matches the path-traversal arbitrary
file upload technique (e.g. CVE-2025-30515 class) against embedded device web interfaces.
Scope to web logs from IoT/VoIP/intercom management interfaces to reduce noise.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
category: webserver
detection:
selection_method:
cs-method:
- POST
- PUT
selection_traversal:
- cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- ..%5c
- '%2e%2e%5c'
- cs-uri-stem|contains:
- ../
- ..\
- '%2e%2e%2f'
- ..%2f
- ..%5c
- '%2e%2e%5c'
condition: selection_method and selection_traversal
falsepositives:
- Web applications that legitimately pass relative paths in upload parameters
- Vulnerability scanners run by the internal security team
level: medium
id: 0761f146-a47d-558b-9484-fda49221a795
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
Blind SQL Injection Probing in Web Request Query String
Detects time-based and boolean blind SQL injection payloads in request URIs/queries, consistent with blind SQLi information disclosure against exposed device web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Blind SQL Injection Probing in Web Request Query String
description: Detects time-delay and boolean-based blind SQL injection payloads (sleep,
benchmark, waitfor delay, always-true conditions) in the query string or URI stem.
Matches blind SQL injection against embedded device web interfaces (e.g. CVE-2025-30507
class). A burst of such requests from one source is a stronger signal.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_time:
cs-uri-query|contains:
- sleep(
- pg_sleep(
- benchmark(
- waitfor delay
- waitfor%20delay
- sleep%28
selection_boolean:
cs-uri-query|contains:
- ''' or ''1''=''1'
- ''' and ''1''=''1'
- ''' and ''1''=''2'
- '%27%20or%20%271%27%3d%271'
- '%27%20and%20%271%27%3d%271'
- or 1=1
- and 1=1
- or%201=1
- and%201=1
condition: 1 of selection_*
falsepositives:
- Authorised web vulnerability scanning
- Applications that pass SQL-like text in search parameters
level: medium
id: 0c73a66a-8d71-5572-97e8-bebce97b7e4c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs