Unauthenticated Endpoint Puts Millions of Intelbras Surveillance Cameras at Risk of Denial-of-Service
Executive Summary
In 2024–2025, Kaspersky researchers discovered a denial-of-service vulnerability (CAN-2026-2035970, CVSS 4.0 score 5.1) in Intelbras IP camera firmware affecting models including the iM3B-C, iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The flaw resided in an unauthenticated firmware upgrade endpoint (/firmwareUpgrade_service/Demo) that accepted any HTTP POST request—regardless of payload validity—and forced the device into a reboot cycle, rendering it offline indefinitely when requests were repeated. With over 4 million downloads of the companion Mibo Smart app across Latin America, the attack surface was substantial. Intelbras patched the issue in firmware R.260804 following responsible disclosure.
This incident underscores the persistent risk of unauthenticated management endpoints in IoT and embedded devices deployed at scale. As surveillance infrastructure becomes more deeply integrated into enterprise and critical-facility security postures, availability-disrupting vulnerabilities in these devices carry operational consequences far beyond a simple device reboot, including blind spots in physical security and compliance gaps under frameworks requiring continuous monitoring.
Why This Matters Now
IoT camera deployments are accelerating across enterprises, healthcare facilities, and critical infrastructure, yet firmware security lags far behind IT standards. With millions of Intelbras devices in active use and a trivially exploitable unauthenticated endpoint, attackers can silently disable physical surveillance at scale—exposing organizations to both security blind spots and regulatory non-compliance—making immediate firmware patching and network segmentation of IoT assets an urgent priority.
Attack Path Analysis
An unauthenticated attacker on the local Wi-Fi network identifies the exposed /firmwareUpgrade_service/Demo endpoint on an Intelbras IP camera and sends a crafted HTTP POST request with an arbitrary firmware payload, triggering a forced reboot cycle without needing valid credentials. Because the endpoint performs no authentication or firmware validation, the attacker can repeatedly send requests to keep the camera offline indefinitely, resulting in a sustained denial-of-service that blinds physical surveillance and disrupts monitoring for millions of users across the affected device fleet.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An attacker with access to the local Wi-Fi network discovers the unauthenticated firmware upgrade endpoint http://<ip_address>/firmwareUpgrade_service/Demo on an Intelbras IP camera. No credentials, session token, or prior exploitation is required. A simple HTTP POST with any firmware file triggers acceptance by the sonia binary, which initiates the upgrade and reboot sequence immediately. This constitutes direct exploitation of an unauthenticated exposed service endpoint (CVE candidate CAN-2026-2035970, CVSS 4.0 score 5.1).
MITRE ATT&CK® Techniques
Network Denial of Service
Exploit Public-Facing Application
Impair Defenses: Disable or Modify Tools
Supply Chain Compromise: Compromise Hardware Supply Chain
Pre-OS Boot
Modify System Image
Network Service Discovery
Endpoint Denial of Service: Application or System Exploitation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Device Identification and Authentication
Control ID: IA-3
CISA Zero Trust Maturity Model 2.0 – Continuous Device Authorization and Validation
Control ID: Device Pillar — Device Authorization
NIS2 Directive – Security of Network and Information Systems — Risk Management and Resilience
Control ID: Article 21(2)(a) and 21(2)(e)
PCI DSS 4.0 – All System Components Are Protected from Known Vulnerabilities
Control ID: Requirement 6.3.3
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities
Control ID: Annex A 8.8
DORA (EU Regulation 2022/2554) – ICT Asset and Endpoint Security Controls
Control ID: Article 9 — ICT Security Policies and Procedures
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer/Network Security
IoT/Embedded Device Vulnerability in Intelbras cameras exposes unauthenticated firmware endpoints, enabling DoS via lateral movement paths, with compliance gaps across NIST.800-53.SC-7 and ZTMM.Network controls.
Public Safety
Unauthenticated DoS attacks against 4M+ Intelbras surveillance camera users disrupt live monitoring capabilities, creating critical physical security blind spots across public safety infrastructure deployments.
Facilities Services
Intelbras IP camera DoS vulnerability threatens facility surveillance continuity; unauthenticated firmware endpoint exploitation disables monitoring, violating NIST.CSF.PR.DS-2 and physical security operational requirements.
Hospitality
Hospitality venues relying on Intelbras IoT camera systems face indefinite surveillance outages via periodic DoS exploitation, undermining guest safety obligations and PCI.4.0 compliance posture.
Sources
- Millions of security cameras at risk: DoS vulnerability in Intelbras deviceshttps://securelist.com/intelbras-camera-vulnerability/121131/Verified
- Intelbras Official Firmware Update Pagehttps://www.intelbras.com/pt-br/suporte/downloads/Verified
- MITRE CVE Program - CNA Rules and Candidate Assignmenthttps://cve.mitre.org/cve/cna.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attack exploits a completely unauthenticated endpoint reachable by any device on the same local network segment, meaning lateral reachability across co-located IoT devices is the core risk amplifier. By enforcing microsegmentation and identity-aware east-west policies, CNSF would likely constrain how broadly an attacker could enumerate and target multiple camera nodes sharing the same vulnerable firmware across a network zone.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level policy could likely reduce the reachability of the exposed firmware upgrade endpoint by constraining which source identities and network segments are permitted to initiate HTTP connections toward camera management surfaces, making casual Wi-Fi-adjacent access less straightforward than an open flat network would allow.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely constrain the scope of what an unauthenticated caller can reach within the broader network environment, even if the camera's own authentication boundary is absent, reducing how far inherited device-level control could extend laterally beyond the compromised node itself.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to freely scan and reach multiple camera endpoints across the subnet, as microsegmentation policies could reduce lateral reachability between devices and limit how many nodes a single attacker position could directly address without crossing a policy enforcement boundary.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized traffic monitoring could likely surface anomalous HTTP request patterns directed at camera management endpoints, giving operators a clearer picture of repetitive or automated traffic flows that would otherwise blend into normal device communication, reducing the window in which the attack loop sustains undetected.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely constrain outbound data paths from within the affected network segment, reducing the risk that any secondary actor operating during the camera blindspot window could exfiltrate data from co-located workloads or connected systems via uncontrolled outbound channels.
Even if the reboot cycle itself cannot be prevented at the camera firmware level, prior stage controls enforced by CNSF would likely have reduced the number of cameras reachable from a single attacker position, constraining the overall scale of the availability impact to a smaller subset of the deployed fleet rather than the entire network zone.
Impact at a Glance
Affected Business Functions
- Physical Security Surveillance and Monitoring
- Remote Camera Management via Mobile Application
- IoT Device Availability and Fleet Management
- Home and Enterprise Security Operations
Estimated downtime: N/A
Estimated loss: N/A
No confidentiality breach or data exfiltration is associated with this vulnerability. The attack vector is a denial-of-service condition triggered by an unauthenticated HTTP POST request to the firmware upgrade endpoint, causing affected Intelbras IP cameras to reboot and go offline for approximately one minute per request, or indefinitely if requests are sent periodically. The primary risk is loss of physical surveillance visibility and availability of live monitoring feeds. Over 4,000,000 downloads of the Intelbras Mibo Smart app indicate a large potential user base affected, predominantly in Brazil, Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay, and Venezuela. No sensitive PII, video recordings, credentials, or private data are confirmed to have been exposed as a result of exploitation. The impact is limited to service availability disruption of security camera systems in home and enterprise environments.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (microsegmentation) to isolate IoT and camera device VLANs from general user and enterprise network segments, ensuring that only authorized management systems can reach firmware update endpoints — directly preventing unauthenticated local-network exploitation of exposed device APIs.
- • Deploy Multicloud Visibility & Control with traffic observability across all network zones to detect anomalous or repeated unauthenticated POST requests targeting firmware endpoints, enabling early identification of automated DoS scripting against camera fleets before widespread disruption occurs.
- • Enforce Egress Security & Policy Enforcement controls on IoT network segments to restrict outbound and lateral traffic to known-good destinations only, limiting an attacker's ability to pivot from a compromised network position to scan for and exploit additional vulnerable camera nodes across the subnet.
- • Leverage Inline IPS (Suricata) with signatures tuned to detect malformed or unauthenticated firmware upload attempts against embedded device HTTP endpoints, providing an additional detection and blocking layer for exploit traffic matching the CAN-2026-2035970 pattern even before firmware patches are universally applied.
- • Implement East-West Traffic Security controls to enforce workload-to-workload and device-to-device policy between camera nodes, preventing an attacker who has compromised one network segment from performing automated subnet scanning and cascading the denial-of-service across all affected Intelbras camera models sharing the vulnerable firmware.
