Kaspersky GReAT discovered a security flaw affecting Intelbras IP camera systems which could impact several million devices in multiple countries. Following Kaspersky notification Intelbras has patched the issue and released updated firmware, - users are advised to verify the firmware version on their devices.
Kaspersky Global Research and Analysis Team (GReAT) team has discovered a vulnerability affecting Intelbras camera systems. The flaw allows affected devices to be taken offline, creating a denial-of-service condition that prevents legitimate users from accessing live monitoring or managing the cameras.
The vulnerable firmware has been downloaded more than 4,000,000 times. The majority of the user base is located in Latin America, with the largest share in Brazil, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela. The security flaw affects iM3B-C model cameras, as well as the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC models, which are also compatible with the affected firmware.
The vulnerability is caused by an insecure firmware upgrade mechanism. The affected endpoint lacks authentication controls and does not verify the validity of uploaded firmware before initiating the upgrade process. As a result, an attacker can trigger a device reboot that causes the camera to shut down temporarily, making it appear offline for approximately one minute to the user and to anyone else with the camera registered on their device.
“For users of the affected cameras, checking the installed firmware version and updating to the latest available release is an effective step in reducing exposure to this issue. Because the vulnerability affects the availability and normal operation of impacted devices, timely updates are particularly important. Maintaining up-to-date firmware remains a fundamental security practice for internet-connected devices, as older versions may remain exposed to known vulnerabilities. We appreciate Intelbras’ swift response and timely remediation of the issue,” - said Tatyana Shishkova, Acting Head of Research Center in Latin America and Europe.
Intelbras informs that, upon becoming aware of the situation, it promptly initiated a technical analysis and adopted the necessary measures, with the involvement of its Research and Development (R&D) team. The necessary update has already been completed. The company maintains continuous monitoring and improvement processes for its products and solutions, reaffirming its commitment to the security and privacy of its users.
The full report is available on Securelist.com
About the Global Research & Analysis Team
Established in 2008, Global Research & Analysis Team (GReAT) operates at the very heart of Kaspersky, uncovering APTs, cyber-espionage campaigns, major malware, ransomware and underground cyber-criminal trends across the world. Today GReAT consists of 35+ experts working globally – in Europe, Russia, Latin America, Asia and the Middle East. Talented security professionals provide company leadership in anti-malware research and innovation, bringing unrivaled expertise, passion and curiosity to the discovery and analysis of cyberthreats.
