Kaspersky finds flaw that can knock Intelbras cameras offline

Kaspersky researchers have disclosed a denial-of-service vulnerability in Intelbras cameras that can be exploited by anyone on the same local Wi‑Fi network. The flaw resides in an unauthenticated firmware update endpoint; sending a single request to that endpoint causes the affected camera to reboot and go offline. Repeated requests keep the device offline for as long as the attacker desires.

The attack requires local network access, so remote exploitation over the internet has not been demonstrated, and there have been no reports of active exploitation in the wild to date.

Intelbras has patched the issue in firmware version R.260804, with MITRE assigning candidate ID CAN-2026-2035970 and a final CVE ID still pending. Kaspersky tested firmware v240927 on the iM3B-C model, noting that the same firmware also runs on several other models: iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The vulnerability is particularly impactful for users of the Mibo Smart app, which has millions of downloads, with Brazil representing the largest user base.

The fix requires authentication to initiate updates via the affected endpoint; users should verify their camera firmware and apply R.260804 as soon as possible.