Unauthenticated firmware upgrade endpoint lets attackers DoS Intelbras cameras
The claim
The authors claim that an unauthenticated firmware upgrade endpoint allows anyone on the local Wi-Fi network to cause a denial-of-service on Intelbras IP cameras.
Published as: “Millions of security cameras at risk: DoS vulnerability in Intelbras devices”
So what
A large installed base of Intelbras cameras could be rendered unavailable by a simple unauthenticated request, highlighting the need for proper authentication on update endpoints.
The five-minute version
The researchers identified an unauthenticated HTTP POST endpoint (/firmwareUpgrade_service/Demo) that triggers a firmware upgrade routine and forces the camera to reboot, causing it to go offline. They demonstrated the exploit on an Intelbras iM3B-C camera using a simple Python script, showing the device becomes unavailable for about a minute per request and indefinitely with repeated calls. Intelbras responded by releasing firmware R.260804 that adds authentication checks, mitigating the issue. The write-up includes CVE tracking information and impact estimates based on the app’s download count.
What they found 2
- The firmware upgrade route lacks authentication and can be triggered without a valid firmware image.
“The affected endpoint is the firmware upgrade route http://<ip_address>/firmwareUpgrade_service/Demo, which lacks authentication checks; furthermore, it fails to verify whether the firmware is actually valid before initiating the upgrade process.”
- Sending an HTTP POST with any firmware file causes the camera to reboot and go offline.
“The exploit is quite simple: it sends an HTTP POST request with the firmware, which causes the camera to accept the request and initiate the reboot process.”
What undercuts it the paper’s own results
- Intelbras released firmware R.260804 that validates cookies and session data before allowing an upgrade, removing the vulnerability.
Stated limits 2
- The attack requires the attacker to be on the same local Wi-Fi network as the camera
- Only devices running firmware versions prior to R.260804 are vulnerable
What’s new here 4
- Discovery of an unauthenticated firmware upgrade endpoint on Intelbras cameras
- Demonstration that a single HTTP POST can reboot and deny service to the device
- Vendor issued a firmware update that adds authentication to the endpoint
- Assignment of a MITRE candidate ID and CVSS 4.0 score of 5.1
Artifacts & methods 3
- Python exploit scriptprimitive
- /firmwareUpgrade_service/Demo endpointsystem
- Intelbras iM3B-C camera firmware v240927dataset