beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
- https://beronet.atlassian.net/wiki/spaces/PUB/pages/88768529/Security+Issues
No PoCs found on GitHub currently.