PT-2024-37371 · Intelbras · Intelbras Incontrol

Stux · Published 2024-06-17 · Updated 2024-11-04 · CVE-2024-6080

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Intelbras InControl version 2.21.56

Description: A critical vulnerability was found in Intelbras InControl, affecting unknown code of the component incontrolWebcam Service. The manipulation leads to an unquoted search path, requiring local access to approach this attack. The exploit has been disclosed to the public and may be used.

Recommendations: For Intelbras InControl version 2.21.56, upgrade to version 2.21.58 to address this issue. It is recommended to upgrade the affected component as soon as possible.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-428

CWE-426

Related Identifiers

CVE-2024-6080

Affected Products

Intelbras Incontrol

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-6080 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6080 · Vendor Advisory
• https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe · Patch
• https://twitter.com/cracbot/status/1804393941862879483 · Twitter Post
• https://t.me/cvenotify/95380 · Telegram Post
• https://vuldb.com/?ctiid.268822 · Note
• https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf · Note
• https://vuldb.com/?submit.353502 · Note
• https://t.me/cvenotify/89359 · Telegram Post
• https://vuldb.com/?id.268822 · Note
• https://t.me/cvenotify/83588 · Telegram Post
• https://t.me/cvenotify/83927 · Telegram Post