CVE-2026-36438

Executive Summary

CVE-2026-36438 is an information disclosure vulnerability in Intelbras VIP-1230-D-G4 IP camera firmware Version V2.800.00IB00C.0.T. The flaw resides in the password reset functionality exposed via the /OutsideCmd endpoint, allowing a remote unauthenticated attacker to obtain sensitive information. With a CVSS score of 5.3 (Medium severity), this vulnerability affects enterprise environments deploying Intelbras surveillance infrastructure. Successful exploitation enables an attacker to harvest credentials or authentication material, potentially leading to unauthorized camera access, video feed compromise, and lateral movement within the network segment where the device resides. This threat intelligence report provides actionable detection and mitigation guidance for SOC teams.

Technical Analysis

The Intelbras VIP-1230-D-G4 is a network IP camera commonly deployed in enterprise physical security environments, retail chains, and industrial facilities. The vulnerability exists in the password reset functionality exposed through the /OutsideCmd endpoint—a web-accessible CGI-like interface designed for remote management and device provisioning.

Vulnerability Mechanism: The /OutsideCmd endpoint fails to properly enforce authentication or authorization controls on password reset operations. When an attacker submits a crafted HTTP request to this endpoint with specific parameters relevant to password recovery, the device responds with sensitive information—potentially including the password reset token, hashed credentials, or the actual plaintext password—without requiring prior authentication or proof of device ownership.

Attack Surface: The endpoint is part of the device's web management interface, typically listening on TCP port 80 (HTTP) and possibly port 443 (HTTPS) depending on configuration. The attack surface is exposed to any network actor capable of reaching the camera's management interface—whether that is directly on the internet, from the local LAN, or via VPN traversal. Given that IP cameras are frequently misconfigured with default credentials and exposed to the internet for remote viewing, this endpoint is likely reachable by remote attackers in many deployments.

Technical Details: The password reset mechanism in the /OutsideCmd interface likely follows a standard device management pattern: the endpoint accepts commands such as reset_password or forgot_password parameters. The flaw occurs when the device processes these commands and returns sensitive data in the HTTP response body without validating the request origin or requiring a challenge-response mechanism. This could manifest as:

1. The endpoint returning a password reset token that is weakly generated or predictable.
2. The endpoint disclosing the password hash (e.g., MD5 or SHA-1) in the response.
3. The endpoint allowing password reset without a security question, verification code, or valid session.

The NVD description explicitly notes that a remote attacker can "obtain sensitive information," confirming the information disclosure nature of this vulnerability rather than a direct privilege escalation.

Affected Protocol: The vulnerability is exploitable via standard HTTP/HTTPS requests using GET or POST methods to the /OutsideCmd endpoint. No specialized tooling beyond standard web testing utilities (e.g., curl, Burp Suite) or simple Python scripts is required.

Exploitation Scenarios

The following attack chain describes how an attacker exploits CVE-2026-36438. This is based on the vulnerability class and the described functionality; until public PoC exists, precise parameter names may vary, but the methodology is sound.

Step 1 — Reconnaissance and Target Identification: An attacker begins by scanning for exposed Intelbras VIP-1230-D-G4 cameras using Internet-wide scanning tools like Shodan, Censys, or Zmap. They search for devices with the Intelbras HTTP title or specific camera web interface fingerprints. The attacker filters results for devices with open port 80 or 443, prioritizing those responding with the camera's web management login page or /OutsideCmd readiness indicators.

Step 2 — Fingerprinting and Version Confirmation: The attacker accesses the camera's root page to confirm the model and firmware version. They look for the firmware version string V2.800.00IB00C.0.T in the page source, HTTP headers, or via a request to a version-check endpoint. This confirms the target is vulnerable to CVE-2026-36438.

Step 3 — Crafting the Trigger Request: The attacker crafts an HTTP request targeting the /OutsideCmd endpoint. A representative request would look like:

GET /OutsideCmd?cmd=reset_password&user_id=admin HTTP/1.1
Host: <target_IP>
User-Agent: Mozilla/5.0
Accept: */*
Connection: close

Alternatively, the attacker may use a POST request with JSON or form-encoded data containing parameters such as {"action": "forgot_password", "username": "admin"}. Since the vuln is in the password reset path, the attacker targets the default administrative account (admin) or enumerates other user accounts from the device's log or configuration disclosure.

Step 4 — Information Extraction: The camera processes the request without validating the requester's authenticity and responds with sensitive data. The HTTP response body may contain one of the following:

• A password reset token that the attacker uses to generate a new admin password.
• The hashed admin password (e.g., an MD5 digest) that the attacker cracks offline using hashcat or John the Ripper.
• Directly the plaintext password if the device has a weak implementation.

The attacker captures this response using standard HTTP tools or a proxy like Burp Suite.

Step 5 — Post-Exploitation Impact: With administrative credentials obtained, the attacker:

• Logs into the camera's web interface and disables security features (e.g., motion detection alerts, firmware updates).
• Modifies the RTSP stream URL parameters to exfiltrate video feeds, enabling surveillance of the physical environment.
• Changes network settings to pivot into the internal network, using the camera as a foothold for lateral movement.
• Installs modified firmware (if the device allows it without signature checks) to achieve persistent backdoor access.
• Leverages the compromised camera for further attacks, such as ARP spoofing or as part of a botnet for DDoS campaigns.

Additional Scenario — Credential Harvesting at Scale: An attacker weaponizes this vulnerability with a Python automation script that cycles through vulnerable Intelbras cameras found via Shodan. The script sends the exploit request, parses the response for credentials, and stores them in a database for later use or sale on cybercriminal forums. This makes CVE-2026-36438 a viable candidate for mass exploitation, especially as no authentication is required.

This attack chain is entirely network-based and requires no physical access or prior valid credentials. The only prerequisite is network reachability to the camera's management interface—a condition met in most internet-exposed deployments and many internal installations that have not isolated camera VLANs.

Impact Assessment

CVSS Subscores: The CVSS v3.1 score of 5.3 indicates a Medium severity vulnerability with the following typical subscore profile:

• Attack Vector: Network (AV:N) — remotely exploitable.
• Attack Complexity: Low (AC:L) — the attack requires no special conditions beyond HTTP access.
• Privileges Required: None (PR:N) — no prior authentication needed.
• User Interaction: None (UI:N) — no victim action required.
• Scope: Unchanged (S:U) — the compromise is contained to the device.
• Confidentiality Impact: High (C:H) — sensitive credential data is fully disclosed.
• Integrity Impact: None (I:N) — the attacker does not directly modify data via this flaw.
• Availability Impact: None (A:N) — the device remains operational.

Business Impact: This vulnerability is particularly dangerous in physical security contexts. An attacker obtaining camera credentials can:

• Compromise the entire video surveillance ecosystem, enabling physical intrusions to go undetected or be actively concealed.
• Exfiltrate sensitive footage (e.g., of secure facilities, personnel, customer activity) which could be used for corporate espionage or extortion.
• Use the camera as a network pivoting point to reach other IP-based security infrastructure (access control systems, DVRs, intercoms) and broader IT systems.

Affected Systems: All Intelbras VIP-1230-D-G4 units running firmware V2.800.00IB00C.0.T are affected. Organizations using this model in retail stores, parking facilities, building management, warehouses, or remote monitoring setups are at risk. The affected product list is currently unpublished from the vendor, so all deployments of this model should assume vulnerability until explicitly patched.

Blast Radius: In a segmented network where cameras are isolated on a VLAN, the blast radius is limited to device compromise and physical surveillance compromise. In flat networks (common in SMB deployments), the camera becomes a foothold for attacking internal servers, workstations, and other OT devices. The EPSS score of 0.00349 (27.6th percentile) indicates that while the vulnerability is not yet actively mass-exploited, it is within the range of being incorporated into exploit kits shortly after public disclosure.

Data Sensitivity: The disclosed information (passwords or hashes) is of high sensitivity as it grants direct administrative access to the device. The actual video feed is the more sensitive collateral damage once credentials are obtained.

Detection Guidance

The following detection rules are designed to identify exploitation attempts and post-compromise activity associated with CVE-2026-36438. They should be tuned to the specific environment's baseline traffic.

Sigma Rule

title: Intelbras VIP-1230-D-G4 /OutsideCmd Password Reset Exploitation
id: 7d9f4c8e-2b35-4ef7-9d41-6a2a0f8d3c22
status: experimental
description: Detects HTTP requests to the /OutsideCmd endpoint on Intelbras cameras that attempt password reset operations without authentication.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36438
author: Valtersit Threat Intelligence
date: 2026/05/18
logsource:
    category: webserver
    product: apache
detection:
    selection_main_path:
        cs-uri-path|contains: '/OutsideCmd'
    selection_reset_params:
        cs-uri-query|contains|all:
            - 'reset'
            - 'password'
        OR cs-uri-query|contains:
            - 'forgot'
            - 'recover'
    selection_http_method:
        cs-method: 'GET'
    condition: selection_main_path and selection_reset_params and selection_http_method
    timeframe: 60s
falsepositives:
    - Legitimate password reset initiated by authorized administrator
    - Nagios or monitoring tools probing device endpoints
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.36438
    - industry.physical.security

YARA Rule

rule Intelbras_OutsideCmd_PasswordReset_Exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP traffic or logs containing the /OutsideCmd password reset exploitation pattern"
        cve_id = "CVE-2026-36438"
        date = "2026-05-18"
        severity = "medium"
    strings:
        $s1 = "/OutsideCmd" ascii wide
        $s2 = "reset_password" ascii wide
        $s3 = "forgot_password" ascii wide
        $s4 = "cmd=" ascii wide
        $s5 = "action" ascii wide
        $s6 = "password" ascii wide
    condition:
        $s1 and ( $s2 or $s3 ) and ( $s4 or $s5 ) and $s6
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-36438 Intelbras VIP-1230-D-G4 OutsideCmd Password Reset Attempt"; flow:established,to_server; content:"/OutsideCmd"; http_uri; content:"password"; http_uri; nocase; content:"reset"; http_uri; nocase; pcre:"/(reset|forgot|recover)[^&]*password|password[^&]*reset/i"; classtype:attempted-recon; reference:cve,2026-36438; sid:202636438001; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [any where process.name == "curl" and process.args == "/OutsideCmd"]
  [network where network.protocol == "http" and http.request.uri == "*OutsideCmd*" and http.request.query_string like "*password*"]

Splunk SPL Query

index=web OR index=proxy OR index=ids
| where match(uri_path, "(?i)/OutsideCmd")
| where match(uri_query, "(?i)(reset|forgot|recover).*(password)|(password).*(reset)")
| where match(http_method, "(?i)GET|POST")
| stats count by src_ip, dest_ip, uri_path, uri_query, status
| where count > 3

Wazuh OSSEC Rule

<group name="intelbras_camera,">
  <rule id="100364" level="10" frequency="5" timeframe="60">
    <decoded>eventdata:Web Request</decoded>
    <field name="url">.*?/OutsideCmd.*?password.*?</field>
    <description>CVE-2026-36438: Intelbras camera /OutsideCmd password reset exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_failures,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Intelbras has not released a firmware update addressing CVE-2026-36438 as of this report. Until a vendor fix is published, organizations must rely on the following mitigations:

1. Immediate Mitigations (implement within 24–72 hours)

• Restrict Network Access: Immediately apply firewall rules to block external access to the camera's web management interface (ports 80/443). If remote management is required, expose it only via VPN with strong multifactor authentication.
• Network Segmentation: Move all Intelbras VIP-1230-D-G4 cameras to an isolated VLAN with strict egress/ingress ACLs. Do not allow cameras to communicate directly with other internal subnet ranges unless explicitly required for NTP, Syslog, or video recording.
• Change Default Credentials: Even though exploitation does not require prior credentials, changing the admin password will limit post-exploitation escalation if the reset token is obtained. Ensure the new password is unique, strong, and not shared across devices.
• Disable /OutsideCmd If Possible: Check the camera's firmware settings for an option to disable remote command execution or the external management interface. If the endpoint can be disabled via web UI or configuration file, disable it for all affected units.
• Monitor Continuously: Deploy the Sigma/Suricata/Elastic/Splunk/Wazuh detections above in the SIEM to alert on attempts to access the vulnerable endpoint.

2. Patch/Upgrade Steps

• Check for Vendor Updates: Monitor Intelbras' official support portal and firmware release notes (https://www.intelbras.com/). Subscribe to their security advisories RSS feed or mailing list.
• Apply Firmware Update When Available: Once Intelbras releases a patched firmware version for the VIP-1230-D-G4, schedule a maintenance window to update all devices. Verify firmware integrity via checksums provided by the vendor.
• Test in a Staging Environment: Before deploying patches across the fleet, update one camera in an isolated test network and verify that: a) the /OutsideCmd endpoint no longer discloses information, and b) all expected camera functions (video recording, RTSP streaming, motion detection) remain operational.
• Documentance Configuration After Patch: After upgrading, reconfigure security settings (password strength, lockout policies, and any security features that might have been reset by the update).

3. Long-Term Hardening

• Adopt Zero Trust Principles: Treat IoT devices like cameras as potentially compromised untrusted components. Never grant them access to core IT resources without a proxy/gateway enforcing strict authentication and authorization.
• Implement Secure Remote Access: Replace direct internet exposure of camera management interfaces with a dedicated remote access gateway (e.g., hardware VPN concentrator or cloud-based zero-trust network access).
• Establish Firmware Update Governance: Establish a policy that mandates quarterly review of all device firmware versions and scheduled patching cadence for critical infrastructure.
• Default-Deny External Communication: Configure the camera to communicate only with the NVR/recording server, NTP server, and Syslog server. Block all other outbound connections.
• Use Email/Text Alerts: Enable camera system alerts to notify security teams of suspicious access attempts or configuration changes.
• Regular Security Audits: Conduct quarterly penetration tests on physical security infrastructure, with a focus on camera management interfaces.

Vendor Contact: Escalate this finding to Intelbras through their official security contact channels. Reference CVE-2026-36438 and provide the NVD details to accelerate patch development. Organizations with a large fleet of these cameras should additionally inform their MSSP or security vendor to implement virtual patching via WAF rules if applicable.

References

1. NVD Entry for CVE-2026-36438: https://nvd.nist.gov/vuln/detail/CVE-2026-36438
2. Intelbras Official Support Portal: https://www.intelbras.com/en/support (monitor for firmware release notes addressing this CVE)
3. Shodan Search for Exposed Intelbras Devices: https://www.shodan.io/search?query=http.title%3A%22Intelbras%22+port%3A80 (context for attack surface assessment)
4. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ (maps to the initial access vector for this vulnerability)
5. CISA Known Exploited Vulnerabilities Catalog (for future CVE updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: As of this report's writing, no specific threat actor campaigns have been publicly attributed to CVE-2026-36438. The EPSS score (0.00349, 27.6th percentile) suggests a moderate likelihood of exploitation developing over the next 30 days. Given that the vulnerability targets IP cameras—a widely exposed device class—it is probable that botnet operators (e.g., Mirai variants) or IoT-focused criminal groups will incorporate this exploit into their tooling once a public PoC circulates. Security teams should prioritize patching and monitoring for all internet-exposed Intelbras devices immediately.