Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Intelbras cameras allow unauthenticated firmware updates that cause DoS

Original title: Millions of security cameras at risk: DoS vulnerability in Intelbras devices

Kaspersky Securelistby João Victor ()5 min read
Read at securelist.com
AI summary · x-ai/grok-4.7Summaries by Vani AI

A local Wi-Fi attacker can keep cameras offline by repeatedly posting to an unauthenticated upgrade endpoint; firmware R.260804 requires authentication.

Kaspersky found a denial-of-service flaw in Intelbras IP camera firmware. The firmwareUpgrade_service/Demo endpoint accepts an upgrade without authentication or a valid image and reboots the camera. Periodic requests can keep it offline. Intelbras released firmware R.260804 after notification; Kaspersky says the flaw is absent from the latest firmware. MITRE assigned candidate CAN-2026-2035970 and a CVSS 4.0 score of 5.1, pending a final CVE.

Unconfirmed: MITRE has not issued a final CVE; CAN-2026-2035970 remains a candidate identifier.

Key facts
  • Research used firmware v240927 on an iM3B-C camera.
  • Intelbras says that firmware also fits iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC.
  • One request disrupts a camera for about a minute.
  • The new firmware checks cookies and session data before an update.
  • Kaspersky published a demonstration that posts firmware to the endpoint.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated local denial of service via forced reboot

ProductAffectedFixed in
Intelbras IP cameras (iM3B-C and compatible models)v240927 on iM3B-C; same firmware also compatible with iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FCR.260804
What to do
  1. 1.Install Intelbras firmware R.260804 using the vendor’s update instructions.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1499 Network Denial of Service
Tags
intelbrasip-camerasdenial-of-servicefirmwareauthentication
Vendors
Intelbras
Products
Intelbras IP camerasiM3B-C
Organizations
KasperskyMITRE

From the original article

5 min read at securelist.com

During our research, we discovered a denial-of-service vulnerability that could affect millions of Intelbras IP camera systems built on the platform platform of a popular Chinese manufacturer.

Kaspersky Securelist

By João Victor · securelist.com

Read the full article at Kaspersky Securelist

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.