Unauthenticated update flaw could repeatedly knock Intelbras cameras offline

Intelbras has patched a firmware vulnerability that allowed anyone on the same network to trigger repeated camera reboots without authentication.

Intelbras has fixed a denial-of-service flaw in its IP camera firmware after researchers found that an unauthenticated update endpoint could be used to force affected devices offline from a local network, according to a report from Kaspersky’s Securelist. The issue affected the firmware upgrade service on Intelbras cameras and was addressed in updated firmware R.260804, which the company released after being notified. MITRE has assigned the issue the candidate identifier CAN-2026-2035970, and Intelbras said the flaw now carries a medium severity rating of 5.1 under CVSS 4.0.

The problem sat inside a firmware update route that did not require authentication and did not properly check whether an uploaded image was valid before starting the upgrade process. In practice, that meant any device on the same Wi-Fi network could send a request that triggered a reboot sequence. A single request would leave the camera unavailable for roughly a minute, but repeated requests could keep it down continuously, creating a denial-of-service condition for users trying to view live video or manage the device.

Securelist said it tested the weakness on an iM3B-C camera running firmware v240927, which Intelbras said was also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC models. The firm’s analysis described the camera’s authentication flow, in which clients first request a challenge at the RPC login endpoint and then compute a hashed response before gaining access to authenticated functions. The vulnerable update service bypassed that control entirely, allowing the reboot path to be reached without a valid session.

The researchers said the weakness could be demonstrated with a simple HTTP POST request carrying firmware data, even if the file was not genuine. That was enough to make the camera enter the update-and-restart sequence and break the link with Intelbras’ mobile application. The company’s own Mibo Smart app has more than 4 million downloads, with its biggest user base in Brazil and significant deployment across Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela, which gives the flaw broad potential reach.

Intelbras said the defect was corrected after it worked with the original equipment manufacturer, and the revised firmware now checks cookies and session data before permitting an update through the endpoint. The case adds to a growing list of security issues disclosed in Intelbras products in recent years, including authentication bypass, information disclosure and path traversal flaws identified in other cameras, routers and recorders. For users of internet-connected surveillance equipment, the practical lesson is familiar: firmware updates should be applied promptly, particularly when a patch closes an unauthenticated route into a device’s availability functions.