Intelbras InControl Vulnerability CVE-2024-9325 and CVE-2024-9324

 Intelbras InControl Vulnerability  

    Recent vulnerabilities have been identified in Intelbras InControl, which pose significant risks to users. Both vulnerabilities are classified as critical, affecting different components of the software.

CVE-2024-9325

    Description: CVE-2024-9325 is a critical vulnerability found in Intelbras InControl versions up to 2.21.56. It affects the executable file located at C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The issue arises from an unquoted search path, which can potentially allow local attackers to execute arbitrary code.

Timeline:

• Vulnerability Disclosure: The vendor was informed about this vulnerability on August 5, 2024.
• Patch Release Announcement: A fixed version (2.21.58) was initially scheduled for release at the end of August 2024 but was postponed to September 20, 2024.

Impact: The unquoted search path can be exploited by an attacker with local access to the system, potentially leading to privilege escalation or execution of malicious code.

CVE-2024-9324

    Description: Similar to CVE-2024-9325, CVE-2024-9324 is also classified as critical and affects Intelbras InControl versions up to 2.21.57. This vulnerability pertains to an unknown functionality within the /v1/operador/ component of the Relatório de Operadores Page, where manipulation of argument fields can lead to code injection.

Timeline:

• Vulnerability Disclosure: The vendor was notified about this issue on July 19, 2024.
• Patch Release Announcement: As with CVE-2024-9325, a fix was announced for version 2.21.58, with the release date also postponed to September 20, 2024.

Impact: This vulnerability allows remote attackers to execute arbitrary code on affected systems, significantly increasing the risk of unauthorized access and data breaches.

Examples of Exploitation

1. CVE-2024-9325 Exploitation Example:
   • An attacker could exploit the unquoted search path by placing a malicious executable in a directory that is first in the search path. When the vulnerable service starts, it may inadvertently execute the attacker's code instead of the intended application.
2. CVE-2024-9324 Exploitation Example:
   • By sending crafted requests to the vulnerable endpoint (/v1/operador/), an attacker could inject malicious code that gets executed by the server, potentially allowing them to gain control over sensitive functionalities or data.

Conclusion

    Both CVE-2024-9325 and CVE-2024-9324 represent serious vulnerabilities within Intelbras InControl that require immediate attention from users and administrators. It is crucial for affected parties to update their software to version 2.21.58 or later as soon as it becomes available to mitigate these risks effectively.