CVE-2025-0784: Intelbras InControl Information Disclosure

CVE-2025-0784 Overview

CVE-2025-0784 affects Intelbras InControl versions up to 2.21.58. The vulnerability resides in the Registered User Handler component, specifically in code reachable via the /v1/usuario/ endpoint. The flaw results in cleartext transmission of sensitive information [CWE-310], exposing user credentials during registration or account management operations. Attackers positioned on the network path can capture the transmitted data without authentication. The vendor addressed the issue in version 2.21.59, and public exploit details have been disclosed.

Critical Impact
Sensitive user data, including passwords, is transmitted in cleartext through the /v1/usuario/ endpoint, enabling network-based interception by adversaries with access to the communication path.

Affected Products

Intelbras InControl versions up to and including 2.21.58
Intelbras InControl Web (intelbras:incontrol_web)
Fixed in Intelbras InControl 2.21.59

Discovery Timeline

2025-01-28 - CVE-2025-0784 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0784

Vulnerability Analysis

The vulnerability is classified as cleartext transmission of sensitive information under [CWE-310]. Intelbras InControl exposes the /v1/usuario/ API endpoint through the Registered User Handler. When clients interact with this endpoint, sensitive fields including passwords are sent without adequate transport-layer protection. An attacker with visibility into network traffic between the client and the server can read the credentials directly. The exploit has been publicly disclosed, though the vendor rates exploitation complexity as high due to the requirement for a network position between client and server.

Root Cause

The root cause is the absence of enforced encryption for sensitive data submitted to the user management API. The /v1/usuario/ handler accepts credential material over channels that do not guarantee confidentiality. Applications transmitting authentication data must enforce Transport Layer Security (TLS) end-to-end and reject unencrypted requests, but the affected versions fail to do so consistently.

Attack Vector

Exploitation requires network access to observe or intercept traffic between InControl clients and the server. Adversaries can leverage traditional man-in-the-middle (MITM) techniques on shared networks, compromised routers, or ARP spoofing on the local segment. Once traffic to /v1/usuario/ is captured, cleartext credentials can be extracted from the request body. The captured passwords can then be reused against InControl or correlated with other systems where users reuse credentials.

No verified public proof-of-concept code is included in the referenced sources. Technical write-ups describing the cleartext exposure are available in the Notion analysis on Intelbras InControl and VulDB entry #293908.

Detection Methods for CVE-2025-0784

Indicators of Compromise

Plaintext HTTP requests to the /v1/usuario/ endpoint containing password or credential fields
Unexpected network captures or packet-sniffing tools observed on segments carrying InControl traffic
Authentication attempts against InControl from IP addresses that previously had passive network visibility but no prior login history

Detection Strategies

Inspect web server and reverse proxy logs for requests to /v1/usuario/ transmitted over non-TLS connections.
Use network traffic analysis to identify InControl sessions negotiated without HTTPS or downgraded to HTTP.
Correlate credential-reuse events across systems following any suspected interception window.

Monitoring Recommendations

Enable full request logging on the InControl application server and forward logs to a centralized analytics platform.
Alert on plaintext protocol usage between InControl clients and the server, especially on the /v1/usuario/ route.
Monitor for changes to registered user accounts and password resets that were not initiated by the account owner.

How to Mitigate CVE-2025-0784

Immediate Actions Required

Upgrade Intelbras InControl to version 2.21.59 or later, which addresses the cleartext transmission issue.
Force password rotation for all InControl users who authenticated on affected versions, as prior credentials may have been captured.
Restrict access to the InControl management interface to trusted network segments until the upgrade is completed.

Patch Information

Intelbras released a corrective build in InControl version 2.21.59. Administrators should validate the running version against the release notes and confirm that requests to /v1/usuario/ are served only over TLS after the update. Additional context is available in VulDB CTI ID #293908.

Workarounds

Place InControl behind a reverse proxy that terminates TLS and rejects any plaintext HTTP connections to /v1/usuario/.
Enforce HTTP Strict Transport Security (HSTS) at the perimeter to prevent client downgrade to unencrypted channels.
Segment the management network so only administrative hosts can reach the InControl endpoint, reducing MITM opportunities.

bash

# Configuration example: enforce TLS-only access at an nginx reverse proxy
server {
    listen 80;
    server_name incontrol.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name incontrol.example.com;

    ssl_certificate     /etc/ssl/certs/incontrol.crt;
    ssl_certificate_key /etc/ssl/private/incontrol.key;
    ssl_protocols       TLSv1.2 TLSv1.3;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    location /v1/usuario/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
    }
}