This vulnerability (CVE-2025-34023) affects the Karel IP Phone IP1211 model. It involves improper limitation of a pathname to a restricted directory (CWE-22) in the web management panel's /cgi-bin/cgiServer.exx endpoint. Specifically, the page parameter is not properly sanitized, enabling remote authenticated attackers to perform path traversal attacks and access arbitrary files on the underlying system. The CVSS 4.0 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, no user interaction, and requiring privileges but no additional authentication factors. Exploitation evidence was observed prior to public disclosure.

Successful exploitation allows remote authenticated attackers to read arbitrary files on the Karel IP1211 IP Phone, potentially exposing sensitive configuration data or credentials stored on the device. This could lead to further compromise of the device or the network it is connected to. The vulnerability does not require user interaction but does require some level of authentication on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web management interface to trusted administrators only and monitor for unusual access patterns. Avoid exposing the management interface to untrusted networks. Follow up with Karel for any forthcoming patches or updates addressing this vulnerability.