CVE-2024-6080
📋 TL;DR
This critical vulnerability in Intelbras InControl allows local attackers to execute arbitrary code through an unquoted search path in the incontrolWebcam Service. Attackers with local access can exploit this to gain elevated privileges on affected systems. Users of Intelbras InControl versions 2.21.56 and 2.21.57 are affected.
💻 Affected Systems
- Intelbras InControl
📦 What is this software?
Incontrol by Intelbras
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Local privilege escalation enabling attackers to gain higher privileges than their current account, potentially leading to persistence or lateral movement.
If Mitigated
Limited impact if proper access controls restrict local user privileges and service execution paths are monitored.
🎯 Exploit Status
Exploit has been publicly disclosed. Attack requires local access but is straightforward to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.21.58
Vendor Advisory: https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf
Restart Required: Yes
Instructions:
1. Download INCONTROL-WEB-2.21.58 from the Intelbras download link. 2. Run the installer to upgrade from affected versions. 3. Restart the system to ensure the updated service loads properly.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local user access to systems running InControl to reduce attack surface.
Service Path Hardening
windowsManually quote the service path in Windows registry to prevent unquoted path exploitation.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\incontrolWebcam" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Intelbras\InControl\incontrolWebcam.exe\"" /f
🧯 If You Can't Patch
- Implement strict least-privilege access controls to limit local user permissions.
- Monitor and audit service execution paths and privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check InControl version via application interface or installed programs list. Versions 2.21.56 or 2.21.57 are vulnerable.Check Version:
Check application settings or installed programs for version number.Verify Fix Applied:
Confirm version is updated to 2.21.58 and verify the incontrolWebcam Service is running from the patched executable.📡 Detection & Monitoring
Log Indicators:
- Unusual service path modifications in Windows Event Logs
- Privilege escalation attempts from local accounts
Network Indicators:
- Unusual outbound connections from the InControl service
SIEM Query:
EventID=4688 AND ProcessName="incontrolWebcam.exe" AND CommandLine CONTAINS unquoted path🔗 References
- https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf
- https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe
- https://vuldb.com/?ctiid.268822
- https://vuldb.com/?id.268822
- https://vuldb.com/?submit.353502
- https://vuldb.com/?ctiid.268822
- https://vuldb.com/?id.268822
- https://vuldb.com/?submit.353502
