CVE-2025-7061 Intelbras InControl operador csv injection
Remote attackers can inject malicious CSV data into Intelbras InControl via the operador endpoint, potentially corrupting exported data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-7061?
CVE-2025-7061 is a medium-severity vulnerability in Intelbras InControl, published on 4 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/operador/. The manipulation leads to csv injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-7061?
It affects 1 product.
Products include Intelbras Incontrol Web.
How do I fix CVE-2025-7061?
No fix has been published for CVE-2025-7061 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-7061 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-7061 exists.
Other vulnerabilities in Intelbras InControl
- CVE-2024-9325 Intelbras InControl incontrol-service-watchdog.exe unquoted search path
- CVE-2025-0784 Intelbras InControl Registered User usuario cleartext transmission
- CVE-2025-6765 Intelbras InControl HTTP PUT Request operador permission
- CVE-2024-9324 Intelbras InControl Relatório de Operadores Page operador code injection
- CVE-2025-4286 Intelbras InControl Dispositivos Edição Page credentials storage
Sources
Also known as GHSA-c7hp-77g4-72w9.