EUVD-2026-30776
GHSA-6p33-rpvq-f3c3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under /OutsideCmd
AnalysisAI
Unauthenticated information disclosure in the Intelbras VIP-1230-D-G4 Wi-Fi dome IP camera (firmware V2.800.00IB00C.0.T) exposes sensitive data through the password reset endpoint at /OutsideCmd. Remote, unauthenticated attackers can query this endpoint directly over the network to retrieve sensitive information - likely credentials or reset tokens - without any prior authentication or user interaction. Publicly available exploit code exists on GitHub (kensh1k/CVE-2026-36438), lowering the bar for exploitation; no CISA KEV listing has been confirmed at time of analysis.
Technical ContextAI
The Intelbras VIP-1230-D-G4 is a Wi-Fi dome camera in the G4 generation lineup marketed primarily in Brazil. The affected firmware version is V2.800.00IB00C.0.T. The vulnerability resides in the device's web management interface, specifically within the /OutsideCmd URI path which exposes password reset functionality without enforcing authentication. This is a classic IoT insecure direct object reference / unauthenticated API endpoint pattern, where sensitive operations - such as password reset flows - are reachable from the network without session validation. No CWE has been assigned by NVD/MITRE, but the behavior is consistent with CWE-306 (Missing Authentication for Critical Function) or CWE-200 (Exposure of Sensitive Information). The CPE data provided is null (cpe:2.3:a:n/a:n/a) indicating the NVD entry lacks a properly mapped product identifier, which may affect downstream scanner detection.
RemediationAI
No vendor-released patch has been identified at time of analysis. Intelbras has not published a security advisory or updated firmware in the referenced sources. Given the absence of a patch, defenders should apply the following compensating controls: (1) Place the camera behind a firewall or NAT boundary and block direct internet access to TCP port 80/443 on the device - this eliminates the network-reachable attack vector at the cost of losing remote web UI access from untrusted networks. (2) Segment IP cameras onto a dedicated VLAN with egress filtering, limiting blast radius if credentials are obtained. (3) If the device supports it, disable the /OutsideCmd or external password reset feature through the admin interface - check the management UI under remote access or account settings; disabling this may prevent self-service password recovery. (4) Monitor web server logs on any reverse-proxy or gateway in front of the camera for requests to /OutsideCmd from unexpected sources as a detection control. Check https://www.intelbras.com/pt-br for firmware update releases and apply any future patch that addresses this endpoint.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today