Intelbras IP cameras vulnerable to denial-of-service attacks via unauthenticated firmware updates

Intelbras IP cameras have been found to contain a denial-of-service vulnerability that allows unauthorized users to disrupt camera functionality through unauthenticated firmware updates. This flaw, identified during research by Kaspersky, poses significant risks to users, particularly in environments where these cameras are integral to security operations. The vulnerability stems from a firmware update endpoint that lacks proper authentication, enabling anyone on the local Wi-Fi network to send requests that can take the cameras offline.

Understanding the Vulnerability

The vulnerability resides in the firmware upgrade process of Intelbras IP cameras, specifically at the endpoint http:///firmwareUpgrade_service/Demo. This endpoint does not require authentication, allowing an attacker to initiate a firmware update without verifying the legitimacy of the request. A single request can disrupt the camera for approximately one minute, but repeated requests can keep the device offline indefinitely. This situation creates a denial-of-service condition, preventing legitimate users from accessing their cameras.

Upon discovering the vulnerability, Kaspersky reported it to Intelbras, which subsequently patched the issue in a new firmware release (version R.260804). The vulnerability has been assigned a candidate ID of CAN-2026-2035970 by MITRE, with a medium severity score of 5.1 under the CVSS 4.0 framework. The updated firmware now requires authentication for firmware updates, effectively mitigating the risk.

Technical Mechanism of the Exploit

The exploit leverages the camera’s firmware upgrade endpoint, which is designed to accept firmware uploads without authentication checks. When an attacker sends an HTTP POST request with any firmware file, the camera initiates a reboot process, causing it to go offline. This behavior is particularly concerning as it does not require the attacker to provide a valid firmware image, making the exploit straightforward to execute.

To illustrate the exploitation process, Kaspersky utilized a Python script to demonstrate how the vulnerability could be exploited on an Intelbras iM3B-C camera. The script sends a request to the vulnerable endpoint, triggering the camera to reboot and disconnecting it from any registered devices. The simplicity of this exploit underscores the critical need for robust security measures in IoT devices.

Impact and User Recommendations

The potential impact of this vulnerability is significant, given the widespread use of Intelbras cameras. The Intelbras Mibo Smart app, which connects users to their cameras, has over 4 million downloads, primarily in Brazil and several other Latin American countries. This broad user base means that a successful exploit could affect a large number of individuals and organizations relying on these devices for security.

In light of this vulnerability, users are strongly advised to verify their camera firmware versions and update to the latest release (R.260804) as soon as possible. Regularly updating firmware is a critical security practice, especially for internet-connected devices, to protect against known vulnerabilities.

Conclusion

This incident highlights the importance of securing IoT devices, particularly those involved in surveillance and security. The Intelbras vulnerability serves as a reminder that even widely used devices can have significant security flaws that, if left unaddressed, can lead to serious operational disruptions. As the landscape of connected devices continues to grow, manufacturers must prioritize security in their design and update processes to safeguard users effectively.

For further details on the vulnerability and the steps taken by Intelbras, refer to the original report by Kaspersky here.