Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras

GReAT researchers report a denial-of-service vulnerability affecting Intelbras IP camera systems, discovered in the firmware update endpoint that is accessible without authentication. A single unauthenticated request to the endpoint can knock cameras offline for about a minute; repeated requests maintain the device in a offline state. The researchers say they notified Intelbras, observed remediation progress, and validated the fix in updated firmware.

Intelbras released firmware R.260804 and accompanying update instructions, with a candidate MITRE ID CAN-2026-2035970 submitted and assigned for final CVE designation; MITRE classifies the vulnerability as Medium, scoring 5.1 on CVSS 4.0. The issue is no longer present in the latest firmware version.

The affected area of the system is the firmware upgrade route at http://<ip_address>/firmwareUpgrade_service/Demo, which lacked authentication checks and did not verify the firmware before initiating an upgrade. The researchers describe how the authentication mechanism operates, including the global[.]login flow and the use of a two-step MD5-based credential calculation, but indicate the vulnerability stems from the upgrade endpoint itself rather than the authentication sequence.

Demonstrations using an iM3B-C camera with firmware version v240927 show that the exploit causes the device to reboot and appear offline to registered clients, regardless of the firmware image's validity. Intelbras’ new firmware enforces authentication to trigger updates and validates session data, cookies, and other safeguards, mitigating the attack vector identified by GReAT.

The researchers note that the potential impact is substantial given the Mibo Smart app’s user base, which exceeds 4,000,000 downloads across Brazil and neighbouring markets.