EN PT-BR
← Voltar ao feed
medium

Unauthenticated firmware-update endpoint in Intelbras IP cameras allows DoS; fixed in firmware R.260804

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 07:00 · coletado há 4 dias

Kaspersky's Securelist researchers disclosed a denial-of-service flaw in Intelbras IP cameras. The firmware upgrade endpoint requires no authentication and does not validate the firmware image. Anyone on the same local Wi-Fi network can send a single HTTP POST to force a reboot that takes the camera offline for about a minute. Repeating the request periodically keeps the device offline indefinitely. Intelbras fixed the flaw in firmware R.260804. MITRE assigned the candidate ID CAN-2026-2035970 (final CVE pending) and rated it Medium, CVSS 4.0 score 5.1.

Detalhes técnicos

  • The vulnerable route is http://<ip_address>/firmwareUpgrade_service/Demo, created by the main ARM binary sonia. It performs no authentication checks and does not verify that the uploaded firmware is valid before starting the upgrade and reboot.
  • Normal authentication uses the global.login RPC method at /RPC2_Login. It is a two-step challenge-response built on MD5 hashes of the username, realm, random value and password, and it yields an authenticated session. The vulnerable endpoint bypasses this mechanism entirely.
  • The proof of concept is a simple Python script that sends an HTTP POST with arbitrary firmware. The camera starts the reboot even if the image is not genuine, loses connection to the registered mobile app and appears offline.
  • Researchers analyzed firmware v240927 for the iM3B-C. Intelbras states the same firmware also covers the iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC models.
  • The patched firmware validates cookies and session data before the update routine runs. The old firmware went straight to the update routine.
  • Impact is availability only: loss of live monitoring and camera management. The Intelbras Mibo Smart app has over 4,000,000 downloads. The user base is largest in Brazil, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela.

Remediação

  • Check the installed firmware version and update to R.260804 or later, following the Intelbras update instructions.
  • Updates can be applied through the camera web interface, the mobile app over the local network, or manually via SD card.
  • Restrict untrusted devices' access to the network segment where the cameras operate.

Linha do tempo

  1. securelist.com ↗ · pub. 28/10/2026 07:00 · coletado 28/10 08:00 primeiro registro

    Unauthenticated firmware-update endpoint in Intelbras IP cameras allows DoS; fixed in firmware R.260804

    ler a análise desta fonte

    Kaspersky's Securelist researchers disclosed a denial-of-service flaw in Intelbras IP cameras. The firmware upgrade endpoint requires no authentication and does not validate the firmware image. Anyone on the same local Wi-Fi network can send a single HTTP POST to force a reboot that takes the camera offline for about a minute. Repeating the request periodically keeps the device offline indefinitely. Intelbras fixed the flaw in firmware R.260804. MITRE assigned the candidate ID CAN-2026-2035970 (final CVE pending) and rated it Medium, CVSS 4.0 score 5.1.

    Technical Details

    • The vulnerable route is http://<ip_address>/firmwareUpgrade_service/Demo, created by the main ARM binary sonia. It performs no authentication checks and does not verify that the uploaded firmware is valid before starting the upgrade and reboot.
    • Normal authentication uses the global.login RPC method at /RPC2_Login. It is a two-step challenge-response built on MD5 hashes of the username, realm, random value and password, and it yields an authenticated session. The vulnerable endpoint bypasses this mechanism entirely.
    • The proof of concept is a simple Python script that sends an HTTP POST with arbitrary firmware. The camera starts the reboot even if the image is not genuine, loses connection to the registered mobile app and appears offline.
    • Researchers analyzed firmware v240927 for the iM3B-C. Intelbras states the same firmware also covers the iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC models.
    • The patched firmware validates cookies and session data before the update routine runs. The old firmware went straight to the update routine.
    • Impact is availability only: loss of live monitoring and camera management. The Intelbras Mibo Smart app has over 4,000,000 downloads. The user base is largest in Brazil, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela.

    Remediation

    • Check the installed firmware version and update to R.260804 or later, following the Intelbras update instructions.
    • Updates can be applied through the camera web interface, the mobile app over the local network, or manually via SD card.
    • Restrict untrusted devices' access to the network segment where the cameras operate.