Intelbras Camera DoS Flaw Allows Disruption from the Local Network

Kaspersky researchers reported a denial-of-service vulnerability in Intelbras IP cameras that allows someone with access to the local Wi-Fi network to take a camera offline without logging in. The researchers notified the company, which released a firmware update to address the flaw; the issue is not present in the latest firmware, according to the report.

Affected devices and authentication

The researchers tested an iM3B-C camera running firmware v240927, which was the latest version available at the time of their research. Intelbras said the same firmware is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC models. The company provides firmware files on its website. Updates can be installed using an SD card or through the web interface and mobile app, which support upgrades over the local network.

A main firmware component is the ARM binary sonia, which handles camera hardware kernel drivers, authentication and livestream recording, among other functions. Authentication uses the global.login RPC method at /RPC2_Login. First, the client sends a username and an empty password.

The camera responds with a challenge containing a temporary session, encryption type, random value and realm. A false response at this stage is normal and does not mean the login has failed, because authentication is not yet complete.

The client then computes an MD5 hash from the username, realm and original password, followed by a second MD5 hash using the username, random value and first hash. It sends the final result and temporary session in a second global.login call. If login succeeds, the camera returns an authenticated session that must be used for subsequent RPC requests, including endpoints for rebooting the device or accessing sensitive information.

Exploitation and remediation

The flaw is in the /firmwareUpgrade_service/Demo route, which does not check authentication or verify that a firmware file is valid before starting the update process. The process causes the camera to reboot and then shut down, making it appear offline to users who have registered it. One request can disrupt a camera for about a minute; periodic requests can keep it offline indefinitely.

The researchers demonstrated the exploit with a Python script against an iM3B-C camera. The script sends an HTTP POST request to the update endpoint, triggering a reboot even if the submitted file is not original firmware. In the demonstration, the camera was initially operating, with its green light on and the app showing it available for viewing.

After the request, it went offline and disconnected from registered devices. While unavailable, legitimate users cannot access its live monitoring or manage the camera.

After the researchers reported the flaw, Intelbras contacted its original equipment manufacturer and released firmware that requires authentication to start an update through the endpoint. The report says the new firmware validates cookies and session data, unlike the older version, which proceeded directly to the update routine. The remediation version cited is R.260804, and Intelbras provided update instructions.

MITRE assigned candidate ID CAN-2026-2035970, pending a final CVE assignment. The Intelbras team also told the researchers that MITRE classified the issue as Medium, with a score of 5.1 under the CVSS 4.0 framework.

Scope and updates

The researchers noted that the Intelbras Mibo Smart app, used to connect and manage the devices, has more than 4,000,000 downloads. Brazil is its largest user base, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela. The report does not state how many devices are actually affected; it says exploitation can prevent legitimate users from accessing the cameras.

Intelbras advises users to check the firmware installed on their devices and update to the latest available version. The report says the newer firmware mitigates this attack path.