# CyberData 011209 SIP Intercom five critical flaws

Published: 2025-06-05 · Severity: elevated · Sectors: telecommunications, government-national, infrastructure
Canonical: https://vorant.io/reports/9dc88406-6210-56d9-88a8-02c7faa51f0a/cyberdata-011209-sip-intercom-five-critical-flaws

> Five vulnerabilities in CyberData 011209 SIP Emergency Intercom before v22.0.1 allow unauthenticated remote code execution and credential theft.

CISA has published an advisory detailing five vulnerabilities affecting the CyberData 011209 SIP Emergency Intercom in versions prior to 22.0.1. These flaws span authentication bypass via alternate paths (CVE-2025-30184, CVSS 9.3), missing authentication on critical functions (CVE-2025-26468, CVSS 8.7), blind SQL injection for information disclosure (CVE-2025-30507, CVSS 6.9), insufficiently protected credentials storage (CVE-2025-30183, CVSS 8.7), and authenticated path traversal for arbitrary file upload (CVE-2025-30515, CVSS 9.3). The most critical issues allow unauthenticated attackers to achieve code execution, access the web interface without credentials, extract sensitive data, or cause denial of service. The device is deployed worldwide in communications, emergency services, and commercial facilities. No public exploitation has been reported at the time of publication. Vendor mitigation requires immediate upgrade to version 22.0.1. Organizations should prioritize patching and isolate affected devices from internet exposure and untrusted networks.

## Mentioned in this report

- Vulnerabilities: CVE-2025-26468, CVE-2025-30183, CVE-2025-30184, CVE-2025-30507, CVE-2025-30515

## Detection guidance (public sample)

### Web Path Traversal in POST/PUT Request to Embedded Device Web Interface

ATT&CK: T1190

Detects POST/PUT requests whose URI or query carries directory traversal sequences, the pattern behind authenticated path-traversal arbitrary file upload on embedded web UIs such as SIP intercoms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Path Traversal in POST/PUT Request to Embedded Device Web Interface
description: Detects POST or PUT requests containing directory traversal sequences
  (plain or URL-encoded) in the URI or query string. Matches the path-traversal arbitrary
  file upload technique (e.g. CVE-2025-30515 class) against embedded device web interfaces.
  Scope to web logs from IoT/VoIP/intercom management interfaces to reduce noise.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
    - POST
    - PUT
  selection_traversal:
  - cs-uri-query|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - ..%5c
    - '%2e%2e%5c'
  - cs-uri-stem|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - ..%2f
    - ..%5c
    - '%2e%2e%5c'
  condition: selection_method and selection_traversal
falsepositives:
- Web applications that legitimately pass relative paths in upload parameters
- Vulnerability scanners run by the internal security team
level: medium
id: 0761f146-a47d-558b-9484-fda49221a795
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
```

### Blind SQL Injection Probing in Web Request Query String

ATT&CK: T1190

Detects time-based and boolean blind SQL injection payloads in request URIs/queries, consistent with blind SQLi information disclosure against exposed device web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Blind SQL Injection Probing in Web Request Query String
description: Detects time-delay and boolean-based blind SQL injection payloads (sleep,
  benchmark, waitfor delay, always-true conditions) in the query string or URI stem.
  Matches blind SQL injection against embedded device web interfaces (e.g. CVE-2025-30507
  class). A burst of such requests from one source is a stronger signal.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_time:
    cs-uri-query|contains:
    - sleep(
    - pg_sleep(
    - benchmark(
    - waitfor delay
    - waitfor%20delay
    - sleep%28
  selection_boolean:
    cs-uri-query|contains:
    - ''' or ''1''=''1'
    - ''' and ''1''=''1'
    - ''' and ''1''=''2'
    - '%27%20or%20%271%27%3d%271'
    - '%27%20and%20%271%27%3d%271'
    - or 1=1
    - and 1=1
    - or%201=1
    - and%201=1
  condition: 1 of selection_*
falsepositives:
- Authorised web vulnerability scanning
- Applications that pass SQL-like text in search parameters
level: medium
id: 0c73a66a-8d71-5572-97e8-bebce97b7e4c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9dc88406-6210-56d9-88a8-02c7faa51f0a/cyberdata-011209-sip-intercom-five-critical-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup