CVE-2025-4286 Intelbras InControl Dispositivos Edição Page credentials storage
Attackers can remotely access unprotected communication credentials stored in the Intelbras InControl Dispositivos Edição Page.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4286?
CVE-2025-4286 is a medium-severity vulnerability in Intelbras InControl, published on 5 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
Which versions are affected by CVE-2025-4286?
It affects 1 product.
Products include Intelbras Incontrol Web.
How do I fix CVE-2025-4286?
No fix has been published for CVE-2025-4286 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4286 exists.
Other vulnerabilities in Intelbras InControl
- CVE-2024-9325 Intelbras InControl incontrol-service-watchdog.exe unquoted search path
- CVE-2025-0784 Intelbras InControl Registered User usuario cleartext transmission
- CVE-2025-6765 Intelbras InControl HTTP PUT Request operador permission
- CVE-2024-9324 Intelbras InControl Relatório de Operadores Page operador code injection
- CVE-2025-7061 Intelbras InControl operador csv injection
Sources
Also known as GHSA-5vrx-97jq-34j7.