CVE-2026-2564

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2564", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-15T19:22:27.386Z", "datePublished": "2026-02-16T16:02:06.547Z", "dateUpdated": "2026-02-23T10:12:32.594Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:12:32.594Z"}, "title": "Intelbras VIP 3260 Z IA OutsideCmd password recovery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-640", "lang": "en", "description": "Weak Password Recovery"}]}], "affected": [{"vendor": "Intelbras", "product": "VIP 3260 Z IA", "versions": [{"version": "2.840.00IB005.0.T", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. It is recommended to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X", "baseSeverity": "CRITICAL"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-02-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-18T15:38:32.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ak7r4 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.346171", "name": "VDB-346171 | Intelbras VIP 3260 Z IA OutsideCmd password recovery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.346171", "name": "VDB-346171 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.741776", "name": "Submit #741776 | Intelbras VIP 3260 Z IA v2.840.00IB005.0.T Weak Password Recovery", "tags": ["third-party-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T14:54:28.001175Z", "id": "CVE-2026-2564", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:54:37.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2564", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T14:54:28.001175Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:54:31.417Z"}}], "cna": {"title": "Intelbras VIP 3260 Z IA OutsideCmd password recovery", "credits": [{"lang": "en", "type": "reporter", "value": "ak7r4 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C"}}], "affected": [{"vendor": "Intelbras", "product": "VIP 3260 Z IA", "versions": [{"status": "affected", "version": "2.840.00IB005.0.T"}]}], "timeline": [{"lang": "en", "time": "2026-02-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-18T15:38:32.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346171", "name": "VDB-346171 | Intelbras VIP 3260 Z IA OutsideCmd password recovery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.346171", "name": "VDB-346171 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.741776", "name": "Submit #741776 | Intelbras VIP 3260 Z IA v2.840.00IB005.0.T Weak Password Recovery", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. It is recommended to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "Weak Password Recovery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:12:32.594Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2564", "state": "PUBLISHED", "dateUpdated": "2026-02-23T10:12:32.594Z", "dateReserved": "2026-02-15T19:22:27.386Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-16T16:02:06.547Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "VIP 3260 Z IA", "vendor": "Intelbras", "versions": [{"status": "affected", "version": "2.840.00IB005.0.T"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /OutsideCmd. La manipulaci\u00f3n resulta en recuperaci\u00f3n de contrase\u00f1a d\u00e9bil. Es posible lanzar el ataque remotamente. Ataques de esta naturaleza son altamente complejos. La explotaci\u00f3n parece ser dif\u00edcil. Se recomienda actualizar el componente afectado."}], "id": "CVE-2026-2564", "lastModified": "2026-06-17T10:31:19.673", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2564", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T14:54:28.001175Z", "version": "2.0.3"}}]}, "published": "2026-02-16T17:18:09.150", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.346171"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.346171"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.741776"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.840.00IB005.0.T"}}], "product": "vip_3260_z_ia", "vendor": "intelbras"}], "analysis": {"en": {"generated_at": "2026-04-17T19:01:58.538240+00:00", "value": {"mitigation_remediation": ["Upgrade the Intelbras VIP\u00a03260\u00a0Z\u00a0IA device to the firmware or component version that includes the fix for the weak password recovery flaw.", "If an upgrade is not immediately possible, remove or restrict external access to the /OutsideCmd endpoint so that unauthorized users cannot trigger the recovery process.", "Enforce a strong, unique password policy for all administrator accounts and monitor access logs for anomalous recovery attempts."], "summary": {"action": "Immediate Patch", "impact": "Password recovery weakness"}, "threat_synthesis": {"affected_systems": "Intelbras VIP\u00a03260\u00a0Z\u00a0IA, firmware version\u00a02.840.00IB005.0.T is vulnerable. No other versions are known to be affected.", "description_and_impact": "A flaw arises from an unprotected functionality in the /OutsideCmd file on Intelbras VIP\u00a03260\u00a0Z\u00a0IA. By manipulating this endpoint, an attacker can trigger the password recovery process and obtain an easily guessable or reset password, revealing the credentials of privileged users. The weakness, categorized as CWE\u2011640, allows the recovery logic to be forced without proper authentication. As a result, the confidentiality of user accounts is compromised and an attacker could gain full control over the device.", "risk_and_exploitability": "The vulnerability has a CVSS score of 9.2, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. The attack vector is remote; an adversary would need to expose the /OutsideCmd endpoint, craft a payload that triggers the weak recovery routine, and then obtain the reset password. While the exploitation pathway is complex, the high impact of credential compromise warrants prompt action."}}}}, "created": "2026-02-17T08:49:30.684927+00:00", "updated": "2026-04-17T19:15:26.244120+00:00", "vendors": ["intelbras", "intelbras$PRODUCT$vip_3260_z_ia"]}