A flaw in Intelbras IP cameras let anyone on the same Wi-Fi network knock the devices offline with a single unauthenticated web request, and keep them offline for as long as they kept sending it. Intelbras has shipped fixed firmware, version R.260804, and owners should install it.
The bug was found by João Victor of Kaspersky, who published the original report on Securelist after Intelbras patched it. The reach is what makes a medium-severity bug worth attention: the Intelbras Mibo Smart app used to manage these cameras has more than 4 million downloads, with Brazil the largest user base, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela.
A firmware update page with no lock on the door
The problem sits in the camera's firmware upgrade route, /firmwareUpgrade_service/Demo. According to Kaspersky, that endpoint performed no authentication check and did not verify that an uploaded file was genuine firmware before starting the upgrade. Because an upgrade forces a reboot, a single HTTP POST carrying any file was enough to send the camera into reboot mode, after which it shut down and appeared offline to the owner and to every phone registered to it.
One request takes a camera down for only about a minute. Sending requests periodically keeps it down indefinitely, which for a security camera means no live view and no way to manage the device while the attack runs. Kaspersky demonstrated the attack with a short Python script against an iM3B-C camera, watching the status light go out and the Mibo app lose its connection.
The researchers tested firmware v240927 for the iM3B-C, the latest version at the time. According to Intelbras, the same firmware is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC models. Kaspersky says the cameras are built on the platform of a popular Chinese manufacturer, and Intelbras passed the report to that OEM vendor to produce the fix.
Medium severity, still waiting on a CVE
MITRE has issued candidate ID CAN-2026-2035970, with the final CVE pending. Intelbras told Kaspersky that MITRE rated the flaw Medium, at 5.1 under CVSS 4.0. The attack needs access to the local network, and the impact is on availability rather than on access to video or settings: Kaspersky describes a denial-of-service condition, not a takeover.
That still matters for a device whose whole job is to be watching when something happens. A camera that anyone on the network can silence is a weaker control than its owner believes. Camera firmware has been a steady source of bugs this year, from a public exploit for 37 VIVOTEK models to flaws that handed strangers live video.
Update to firmware R.260804
The fixed firmware requires an authenticated session, checking cookies and session data, before the upgrade endpoint will accept a request. Kaspersky validated the fix and says the issue is no longer present in the latest release. Intelbras has published update instructions alongside R.260804.
- Check the firmware version on each Intelbras camera and update to R.260804 or later.
- Keep cameras on a network segment that guests and untrusted devices cannot join, since the attack only needs local network access.
- Treat unexplained camera dropouts as a possible warning sign, not just a glitch.
For owners across Brazil and its neighbours, the fix is a routine firmware update. The lesson is less routine: an update mechanism that trusts anyone is itself an attack surface.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.