Intelbras IP Cameras Exposed to Denial-of-Service Vulnerability

The Intelbras Mibo Smart app has over 4,000,000 downloads — a scale that helps explain why a single unauthenticated firmware endpoint mattered so much.

How the camera authenticates: the sonia handshake and MD5 challenge

At the center of these devices’ access controls is an ARM binary named sonia, which the vendor uses to manage kernel drivers, authentication and livestream recording. Authentication is handled by a global.login RPC method at /RPC2_Login. A client first sends a username and an empty password; the camera replies with an authentication challenge that returns a temporary session, an encryption type, a random value and a realm. The client then computes an MD5(username:realm:original_password), and from that computes MD5(username:random:first_md5). Returning that second MD5 with the temporary session completes authentication and, if accepted, yields a new, authenticated session required for subsequent RPC calls and endpoints.

The vulnerable endpoint: /firmwareUpgrade_service/Demo accepted unauthenticated updates

The flaw discovered resides in the firmware upgrade route at http://<ip_address>/firmwareUpgrade_service/Demo. That endpoint did not perform authentication checks and did not verify whether an uploaded firmware image was valid before starting the upgrade routine. Because the upgrade path forces the device to reboot, an unauthenticated caller can initiate a reboot sequence simply by POSTing firmware data to the endpoint.

Proof-of-concept and operational impact

Researchers used a Python script against an iM3B-C camera running firmware v240927 (the version obtained for the research) to demonstrate exploitation. Sonia creates the firmware endpoint; the exploit sends an HTTP POST with the firmware and the camera accepts it and begins the reboot process. The rebooted camera appears offline to mobile phones registered to the device and to other management interfaces. A single request typically disrupts the camera for about a minute; however, periodically issuing the same request keeps the device offline indefinitely, creating a sustained denial-of-service condition.

The exploit does not require a valid firmware image — the camera will start the reboot process regardless of whether the uploaded file is genuine or properly signed. The researchers observed the camera transition from normal operation (green light on, app showing the feed) to offline after the exploit executed.

Intelbras response: patch R.260804 and MITRE tracking

After notification, Intelbras coordinated with its OEM vendor and released an updated firmware — designated R.260804 — and accompanying update instructions. The new release requires authentication to initiate an update through the previously unauthenticated endpoint and validates cookies and session data before entering the update routine. The researchers validated that the issue is no longer present in the latest firmware version.

Following submission, MITRE assigned a candidate ID of CAN-2026-2035970 pending a final CVE and classified the vulnerability as Medium with a score of 5.1 under CVSS 4.0, according to the Intelbras team.

What this means for technologists, end users, and procurement teams

• Technologists and security teams: Verify whether affected models — including iM3B-C and the firmware-compatible iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC — are deployed, and update devices to firmware R.260804. Firmware can be installed manually via SD card or pushed over the local network through the camera web interface or mobile app.
• End users and the general public: If you manage or rely on Intelbras cameras via the Mibo Smart app (noting that the app has more than 4,000,000 downloads and a large user base in Brazil and several South American countries), check the device firmware version and apply the vendor update as soon as possible to remove the unauthenticated upgrade path.
• Procurement and operations leaders: Factor firmware management practices into device lifecycle processes — devices that support local and SD-card updates still need a verified, repeatable process to ensure timely patching to mitigate availability-impacting flaws.

The vulnerability demonstrates a simple but consequential failure mode: an unauthenticated, poorly validated firmware endpoint that forces a reboot can be weaponized to deny access to surveillance streams at scale. Intelbras has issued a fix and researchers have validated the remediated behavior; the remaining, concrete step for users is straightforward and urgent — confirm firmware versions on deployed devices and apply R.260804 per the vendor’s instructions.

Original report: https://securelist.com/intelbras-camera-vulnerability/121131/