Kaspersky's Global Research and Analysis Team (GReAT) published details on 28 October 2026 of a denial-of-service flaw in several Intelbras IP cameras. Intelbras is a Brazilian brand, and its Mibo Smart app has more than 4 million downloads. Most users are in Brazil, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay and Venezuela.

What the bug does

The camera firmware exposes an endpoint at /firmwareUpgrade_service/Demo that accepts requests without any login. It also does not check whether the uploaded file is valid firmware. Researcher João Victor found that a single POST request to it makes the camera reboot. The device is then offline for about a minute. Repeat the request every so often and the camera never comes back, so it records nothing for as long as the attacker keeps going.

The catch for an attacker is reach: they need access to the same local network, for example by being on the household Wi-Fi. This is not an internet-wide takeover, and the bug does not give code execution or access to recordings. Kaspersky still points out that a camera quietly kept offline is exactly what a burglar would want.

Affected models and the fix

Kaspersky tested firmware v240927 on an iM3B-C (IM3 C). The same firmware is used by these models:

  • iMX C
  • iM4 C
  • iM5 SC
  • iME 360 C
  • iM7+ FC

Most of the logic lives in a binary called sonia. The normal login path goes through /RPC2_Login with an MD5 challenge, but the upgrade endpoint skipped that check entirely. Intelbras fixed it in firmware R.260804, where the endpoint now requires an authenticated session. MITRE has assigned candidate ID CAN-2026-2035970, and a final CVE number is still pending. The CVSS 4.0 score is 5.1, rated Medium. Intelbras also passed the report to the OEM vendor that supplies the firmware, so similar cameras sold under other brands may share the code.

What to do

If you have one of these cameras, update it to R.260804 or later. It also helps to put cameras on a separate network segment or guest network, so a visitor's phone or a compromised laptop on the main Wi-Fi cannot reach them. If you record to an NVR or to Home Assistant, set up an alert for a camera that goes unavailable. A camera dropping off for a minute at a time is worth a look.