Millions of security cameras at risk: DoS vulnerability in Intelbras devices

How authentication works

PoC: vulnerability exploitation

New firmware version

Network-connected surveillance cameras are now widespread in both home and enterprise environments, so securing them is essential to safeguarding physical spaces and sensitive assets. As these devices continue to gain new features and network connectivity capabilities, vulnerabilities in their implementation can have significant security implications.

During our research, we discovered a denial-of-service vulnerability that affects Intelbras IP cameras systems. The flaw resides in a firmware update endpoint that is accessible without authentication and allows anyone with access to the local Wi-Fi network to knock cameras offline. A single request disrupts the camera for only about a minute, but sending periodic requests keeps the device offline indefinitely. We reported the issue to Intelbras, monitored the remediation process, validated the fix in the new firmware, and will now demonstrate the exploitation procedure step-by-step.

Following our notification, Intelbras patched the vulnerability and released updated firmware ( R.260804 ) along with update instructions . A candidate ID of CAN-2026-2035970 has been assigned by MITRE following submission, pending the final CVE assignment. Additionally, the Intelbras team recently informed us that MITRE has classified the vulnerability as Medium, assigning it a score of 5.1 under the CVSS 4.0 framework. The issue discussed in this article is no longer present in the latest firmware version.

Intelbras provides firmware files on its official website. While users can manually install these updates via an SD card, the cameras also natively support firmware upgrades over the local network via their web interface and mobile app. We obtained the firmware version v240927 for the iM3B-C camera, which was the latest available version at the time of our research. According to Intelbras, the same firmware is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC models. Below, we can view the firmware version and the camera model used as an example.

To provide context, we will explain how the camera’s authentication mechanism works and why it is relevant to accessing the camera’s endpoints. The main firmware component is an ARM binary named sonia , responsible for controlling the kernel drivers used by the camera hardware, authentication, and livestream recording, among other things.

The global.login RPC method handles authentication at the /RPC2_Login endpoint. First, the client, such as the mobile app or a custom script, sends the username and an empty password. The camera responds with an authentication challenge (a set of values to verify the password without transmitting it). This response returns a temporary session, the encryption type in the encryption field, a random value, and a realm (authentication scope). At this stage, a false response is normal and does not indicate a failed login, as the authentication process is not yet complete.

Next, the client calculates the response password from the authentication challenge . It first generates an MD5 (username:realm:original_password) hash as the base. It then calculates a second MD5 (username:random:first_md5) hash, where first_md5 is the result of the previous step . To complete the authentication, the client sends this final result back to /RPC2_Login in a second global.login call, passing the username, calculated password, and temporary session ID.

If the login is accepted, the camera returns true and a new, authenticated session. This session must be used for all subsequent RPC calls, including the camera’s other endpoints, for example, the one that reboots the device or those that expose sensitive information.

The affected endpoint is the firmware upgrade route http://<ip_address>/firmwareUpgrade_service/Demo , which lacks authentication checks; furthermore, it fails to verify whether the firmware is actually valid before initiating the upgrade process. This creates a serious issue because the upgrade requires the camera to reboot, and that is precisely when the problem occurs: the camera enters reboot mode and eventually shuts down, appearing offline to the user and anyone who has the camera registered on their device.

Now that we have outlined how the vulnerability works, we will use a Python script on an iM3B-C camera to exploit it for demonstration purposes. The exploit contacts the camera’s endpoint to upload firmware. Below, we can see sonia creating the endpoint responsible for the firmware upgrade.

Next, the exploit will hit the endpoint and cause the camera to reboot. Consequently, mobile phones running the Intelbras app will lose connection with the registered device. Below, we can see the camera operating normally: the green light is on and the app is showing it is available for viewing.

The camera is online

After the exploit executes, we can see the effects: the camera goes offline and loses connection to the registered devices.

The camera is offline

The exploit is quite simple: it sends an HTTP POST request with the firmware, which causes the camera to accept the request and initiate the reboot process. It does not matter whether the firmware is original; the reboot process will start regardless.

After we notified Intelbras about this flaw in the endpoint implementation, the company contacted the OEM vendor. As a result, a new firmware version was released that requires authentication to initiate an update through this endpoint.

Below, we can compare the new firmware, which validates cookies and session data, with the old firmware, which performed no authentication checks and proceeded directly to the update routine.

An attacker can remotely trigger the camera firmware upgrade and reboot process without authenticating or supplying a valid firmware image. This may cause the device to go offline, which results in a denial-of-service condition preventing legitimate users from accessing live monitoring or managing the camera.

The potential impact is significant due to the number of affected users. The Intelbras Mibo Smart app , which the company provides to connect and manage the devices mentioned in this report, has over 4,000,000 downloads. Brazil represents the largest user base, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay, and Venezuela. As a result, exploitation of this issue affects a large number of users.

This is a medium-severity vulnerability that Intelbras is already aware of. The issue has been addressed in a newer firmware release ( R.260804 along with update instructions ), which mitigates this attack vector. Because the vulnerability directly affects the availability and normal operation of the affected cameras, it is highly recommended that users verify the firmware version currently installed on their devices and update to the latest available version as soon as possible. Keeping the firmware up to date is an essential security practice, especially for internet-connected surveillance devices, as outdated versions may remain exposed to known vulnerabilities.

Millions of security cameras at risk: DoS vulnerability in Intelbras devices

This site uses Akismet to reduce spam. Learn how your comment data is processed.

In the same category

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Operation FlashHole: Lazarus breaks security, defies control

The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

身份验证的工作原理

PoC：漏洞利用

新固件版本

联网监控摄像头如今已广泛应用于家庭和企业环境，因此确保其安全对于保护物理空间和敏感资产至关重要。随着这些设备不断增加新功能和网络连接能力，其部署中的漏洞可能会造成严重的安全隐患。

在研究过程中，我们发现了一个影响 Intelbras IP 摄像头系统的拒绝服务漏洞。该漏洞存在于一个无需身份验证即可访问的固件更新端点中，任何能够访问本地 Wi-Fi 网络的人都可以使摄像头离线。单次请求只会使摄像头中断约一分钟，但定期发送请求则会导致设备无限期离线。我们已将此问题报告给 Intelbras，并监控了修复过程，验证了新固件中的修复方案。现在，我们将逐步演示该漏洞的利用过程。

收到我们的通知后，Intelbras 已修复该漏洞并发布了更新固件（R.260804）及更新说明。MITRE 已提交该漏洞的候选 ID CAN-2026-2035970，目前正在等待最终的 CVE 编号。此外，Intelbras 团队近期告知我们，MITRE 已将该漏​​洞评为中等风险，并根据 CVSS 4.0 框架将其评分为 5.1 分。本文讨论的问题已在最新固件版本中修复。

Intelbras 在其官方网站上提供固件文件。用户可以通过 SD 卡手动安装这些更新，同时，摄像机也支持通过其网页界面和移动应用程序在本地网络上进行固件升级。我们获得了 iM3B-C 摄像机的固件版本 v240927，这是我们研究时可用的最新版本。据 Intelbras 称，该固件也兼容 iMX C、iM4 C、iM5 SC、iME 360 C 和 iM7+ FC 型号。以下列出了固件版本和示例摄像机型号。

为了提供背景信息，我们将解释摄像头的身份验证机制的工作原理以及它与访问摄像头端点之间的关联性。主要的固件组件是一个名为 sonia 的 ARM 二进制文件，它负责控制摄像头硬件使用的内核驱动程序、身份验证以及实时流录制等功能。

global.login RPC 方法处理 /RPC2_Login 端点的身份验证。首先，客户端（例如移动应用或自定义脚本）发送用户名和空密码。摄像头会返回一个身份验证质询（一组用于验证密码的值，但不会传输密码本身）。此响应会返回一个临时会话、加密字段中的加密类型、一个随机值以及一个域（身份验证范围）。在此阶段，返回 false 响应是正常的，并不表示登录失败，因为身份验证过程尚未完成。

接下来，客户端根据身份验证质询计算响应密码。它首先生成一个 MD5 (username:realm:original_password) 哈希值作为基准。然后，它计算第二个 MD5 (username:random:first_md5) 哈希值，其中 first_md5 是上一步的结果。为了完成身份验证，客户端通过第二次 global.login 调用将最终结果发送回 /RPC2_Login，并传递用户名、计算出的密码和临时会话 ID。

如果登录成功，摄像头将返回 true 并创建一个新的已认证会话。所有后续的 RPC 调用都必须使用此会话，包括摄像头的其他端点，例如重启设备的端点或泄露敏感信息的端点。

受影响的端点是固件升级路径 http://<ip_address> /firmwareUpgrade_service/Demo 缺少身份验证检查；此外，它在启动升级过程之前未能验证固件是否有效。这会造成严重问题，因为升级需要摄像头重启，而问题恰恰发生在重启时：摄像头进入重启模式并最终关机，用户以及任何在其设备上注册了该摄像头的用户都无法看到摄像头处于离线状态。

现在我们已经概述了漏洞的工作原理，接下来我们将使用一个 Python 脚本在 iM3B-C 摄像头上演示如何利用该漏洞。该漏洞利用程序会连接到摄像头的端点以上传固件。下图展示了 sonia 创建负责固件升级的端点的过程。

接下来，该漏洞会攻击终端并导致摄像头重启。因此，运行 Intelbras 应用的手机将与已注册的设备断开连接。下图显示摄像头正常运行：绿灯亮起，应用显示摄像头可供查看。

摄像头已上线

漏洞利用执行后，我们可以看到其后果：摄像头离线并与已注册的设备失去连接。

摄像头已离线

这个漏洞利用方法很简单：它向摄像头发送一个包含固件的 HTTP POST 请求，导致摄像头接受该请求并启动重启过程。固件是否为原厂固件并不重要，重启过程都会启动。

在我们向 Intelbras 通报了终端实现中的这一缺陷后，该公司联系了 OEM 厂商。随后，厂商发布了新的固件版本，该版本要求通过此终端进行更新时必须进行身份验证。

下面，我们可以将验证 cookie 和会话数据的新固件与不执行身份验证检查并直接进行更新例程的旧固件进行比较。

攻击者无需进行身份验证或提供有效的固件映像，即可远程触发摄像头固件升级和重启过程。这可能导致设备离线，从而造成拒绝服务攻击，使合法用户无法访问实时监控或管理摄像头。

由于受影响用户数量众多，潜在影响十分显著。Intelbras Mibo Smart 应用是该公司提供的用于连接和管理本报告中提及的设备的应用程序，下载量已超过 400 万次。巴西是用户数量最多的国家，其次是巴拉圭、厄瓜多尔、哥伦比亚、阿根廷、智利、秘鲁、玻利维亚、乌拉圭和委内瑞拉。因此，该漏洞的利用将影响大量用户。

这是一个中等严重程度的漏洞，Intelbras 已获悉。该问题已在新版固件（R.260804，并附有更新说明）中得到解决，从而缓解了此类攻击。由于该漏洞直接影响受影响摄像头的可用性和正常运行，强烈建议用户检查设备上当前安装的固件版本，并尽快更新至最新版本。保持固件更新是一项重要的安全措施，尤其对于联网监控设备而言，因为过时的固件版本可能仍然存在已知漏洞的风险。

数百万个安全摄像头面临风险：Intelbras 设备存在拒绝服务攻击漏洞

本网站使用 Akismet 来减少垃圾邮件。了解您的评论数据如何处理。

同一类别

APT41如何复活黑莲花入侵工具包，攻击中亚外交机构

“闪光洞行动”：拉撒路突破安全防线，无视控制

《奥德赛》和特洛伊木马再次出现：MovieReaper 通过被入侵的种子文件攻击多个国家的用户

Mirage Kitten 正在针对中东和非洲的航空和金融科技行业推出一套新的恶意软件。

APT 组织 HoneyMyte 升级了 CoolClient：后门程序获得了内核级 Windows rootkit。