LiveActive security incident?Get immediate response
CVE Record

CVE-2020-24285: INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through...

INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-24285 is an information disclosure issue reported in Intelbras Telefone IP TIP200 version 60.61.75.22. A specific CGI endpoint can expose sensitive information. There is no CVSS score, named CWE, or vendor fix information in the provided sources, so urgency depends on whether these phones are deployed and reachable from untrusted networks.

Executive priority

Prioritize if TIP200 phones are internet-accessible or on flat internal networks. For segmented voice networks, handle through normal vulnerability management while confirming vendor guidance.

Technical view

The CVE record describes sensitive information exposure through /cgi-bin/cgiServer.exx on Intelbras TIP200 firmware 60.61.75.22. The public record does not define authentication requirements, affected configurations, CVSS metrics, or remediation. Treat exposed web management interfaces on this model and firmware as the primary validation focus.

Likely exposure

Exposure is likely limited to organizations using Intelbras TIP200 IP phones running version 60.61.75.22, especially if device web interfaces are reachable from user, guest, VPN, or internet-facing networks.

Exploitation context

The CVE is public and names the vulnerable endpoint. The source bundle does not show CISA KEV listing, active exploitation, exploit maturity, or confirmed weaponization. Do not assume exploitation without local evidence.

Researcher notes

Public evidence is sparse: the CVE description identifies the product, firmware version, and endpoint, but omits CVSS, CWE, authentication context, and fix status. Further analysis should rely on vendor documentation and controlled lab validation, not production probing.

Mitigation direction

  • Inventory Intelbras TIP200 phones and record firmware versions.
  • Check Intelbras or reseller guidance for fixed firmware or configuration advice.
  • Restrict phone web interfaces to trusted management networks only.
  • Block internet exposure to TIP200 management interfaces.
  • Retire or isolate devices that cannot be updated safely.

Validation and detection

  • Identify any TIP200 devices running firmware 60.61.75.22.
  • Confirm whether web management is reachable from untrusted networks.
  • Review access logs for requests to /cgi-bin/cgiServer.exx.
  • Verify segmentation controls limit access to authorized administrators.
  • Document vendor advisory status and remediation decisions.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-24285 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
2Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.