VULNpocalypse
MediumVulnerabilityPatch available

Intelbras IP cameras: Kaspersky reports DoS flaw in firmware update endpoint

Kaspersky reports an unauthenticated DoS flaw in Intelbras IP camera firmware, update affected cameras to firmware R.260804 as soon as possible.

Published
Fixed in
Intelbras firmware R.260804, according to Kaspersky
Exploitation
Not confirmed. Kaspersky published a proof-of-concept demonstration but does not report exploitation in the wild.

What happened

Kaspersky’s GReAT team reports a denial-of-service vulnerability in Intelbras IP cameras. According to Kaspersky, the camera’s firmware upgrade endpoint, /firmwareUpgrade_service/Demo, does not require authentication and does not check that an uploaded firmware image is valid before it starts the upgrade Kaspersky Securelist.

Kaspersky says that a single HTTP POST request to this endpoint makes the camera reboot and go offline for about a minute. The researchers say that sending requests periodically keeps the device offline indefinitely. In the main description, Kaspersky says the flaw can be triggered by “anyone with access to the local Wi-Fi network”. In its risk section, Kaspersky describes the trigger as remote. Kaspersky demonstrated the issue with a Python script against an iM3B-C camera Kaspersky Securelist.

Kaspersky says it reported the issue to Intelbras. It says Intelbras then contacted its OEM vendor and released firmware R.260804, which requires authentication on this endpoint. Kaspersky says it validated that fix. The researchers also say MITRE assigned a candidate ID, CAN-2026-2035970, and that a final CVE has not yet been assigned. Kaspersky also reports that Intelbras told them MITRE rated the issue Medium, with a CVSS 4.0 score of 5.1 Kaspersky Securelist.

Several points are not confirmed by an independent source:

  • No final CVE ID has been assigned yet.
  • An Intelbras advisory is not among the sources for this article.
  • The number of exposed devices is not confirmed. Kaspersky’s “millions” framing is based on the Intelbras Mibo Smart app having over 4,000,000 downloads, which is not a count of vulnerable cameras.

Am I affected?

According to Kaspersky, you may be affected if all of the following apply:

  • Model: you use an Intelbras iM3B-C (IM3 C) camera, or a model that Intelbras says uses the same firmware: iMX C, iM4 C, iM5 SC, iME 360 C or iM7+ FC Kaspersky Securelist.
  • Firmware: the camera runs firmware older than R.260804. Kaspersky tested v240927, which was the latest version available at the time of its research Kaspersky Securelist.

Kaspersky reports that the Mibo Smart app’s largest user base is in Brazil, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela Kaspersky Securelist.

Whether other Intelbras models or firmware lines are affected is not confirmed.

What to do now

  1. Check the firmware. Look up the version installed on each Intelbras camera using its web interface or the app.
  2. Update to R.260804. Kaspersky says Intelbras provides firmware files on its official website. According to Kaspersky, the update can be installed from an SD card, through the web interface or through the mobile app Kaspersky Securelist.
  3. Confirm the update. After updating, check that each camera reports the new version and reconnects to registered devices.

Sources