Denial-of-Service Vulnerability in Intelbras IP Cameras Leaves Millions Exposed
A critical denial-of-service vulnerability in Intelbras IP cameras allows unauthenticated local network attackers to render devices offline indefinitely.
Security researchers have uncovered a significant denial-of-service (DoS) vulnerability affecting numerous Intelbras IP camera models, including the popular iM3B-C. The flaw, identified as CAN-2026-2035970 and assigned a CVSS score of 5.1, permits any unauthenticated user on the local network to repeatedly trigger a firmware update endpoint. This action causes the cameras to reboot and subsequently go offline, with repeated triggers ensuring they remain inaccessible.
The vulnerability resides within the /firmwareUpgrade_service/Demo endpoint, which crucially lacks any authentication checks. Furthermore, it fails to validate the integrity or legitimacy of the firmware being uploaded before initiating the reboot process. This oversight means that even a malformed or invalid firmware file can trigger the disruptive reboot sequence, effectively disabling the camera's functionality and disrupting surveillance operations.
Exploitation is straightforward, requiring only an HTTP POST request to the vulnerable endpoint containing firmware data. While a single request might only cause a brief outage of about a minute, an attacker can automate these requests to keep the camera offline indefinitely. This poses a substantial risk to businesses and individuals relying on these devices for security, as it can be used to blind surveillance systems.
Intelbras was notified of the vulnerability and has since released a patched firmware version, R.260804. This updated firmware addresses the issue by implementing proper authentication checks on the firmware update endpoint, ensuring that only authorized users with valid session data can initiate updates. The company also provided update instructions for users to manually install the patch via an SD card or through the device's web interface and mobile application.
The affected devices include a range of Intelbras IP cameras, with the firmware version v240927 being confirmed vulnerable on the iM3B-C model. Intelbras states that this firmware is also compatible with several other models, including the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC, indicating a potentially wide attack surface.
The authentication mechanism on these cameras involves an RPC method (global.login) that uses a challenge-response system based on MD5 hashing. However, the firmware update endpoint bypassed this entire authentication process, making it an easy target for attackers who gain even limited access to the local network.
With the widespread deployment of IP cameras in both residential and enterprise environments, vulnerabilities like this highlight the critical need for robust security practices. The ease of exploitation and the direct impact on surveillance capabilities underscore the importance of timely patching and regular security audits for Internet of Things (IoT) devices.