Intelbras vulnerabilities
We track 16 vulnerabilities in Intelbras products across 15 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest Intelbras vulnerabilities
- 9.8 Critical severity
SG 2404 PoE L2+: Improper Authentication
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack
- 8.8 High severity
TIP 635G: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping Handler. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could b
- 8.1 High severity
VIP 3260 Z IA: Weak Password Recovery Mechanism for Forgotten Password
A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remote
- 7.5 High severity
ICIP: Insufficiently Protected Credentials
A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of credentials. The attack
- 8.4 High severity
Iwr 3000n Firmware: Exposure of Sensitive Information to an Unauthorized Actor
Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint.
- 7.3 High severity
Rx 1500 Firmware: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network.
- 7.3 High severity
Rx 1500 Firmware: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device.
- 9.8 Critical severity
Rx 1500 Firmware: Improper Neutralization of Special Elements used in a Command
An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.
- 9.8 Critical severity
Rx 1500 Firmware: Improper Access Control
An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings.
- 8.8 High severity
InControl: Authorization Bypass Through User-Controlled Key
A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The
- 7.8 High severity
InControl: Untrusted Search Path
A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to u
- 8.8 High severity
InControl: Improper Control of Generation of Code
A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the argument fields
- 7.8 High severity
InControl: Untrusted Search Path
A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Service. The manipulation leads to unquoted search path. Local access is required to approach this attack.
- 8.1 High severity
Action Rf 1200 Firmware: Insecure Storage of Sensitive Information
Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.
- 7.5 High severity
sg_2404_mr: Missing Authorization
An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
- 8.8 High severity
Wifiber 120ac Inmesh Firmware: Improper Neutralization of Special Elements used in an OS Command
Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute.