critical advisory November 9, 2026

Intelbras SG 2404 PoE L2+: Improper authentication in Web Management Interface (CVE-2026-124577)

A remote, unauthenticated authentication bypass vulnerability exists in the Web Management Interface of Intelbras SG 2404 PoE L2+ switches via the /EXCU_SHELL file, for which public exploit code is available.

Triage facts

Revision 1

Applicability: SG 2404 PoE L2+ (1.00.70, 1.00.72)
Evidence: Unknown
Severity: Critical
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 9, 09:37 UTC
Vulnerabilities: 1 CVE
Source quality: A2Roughly even chance

A critical improper authentication vulnerability exists in the Web Management Interface of the Intelbras SG 2404 PoE L2+ switch (firmware versions 1.00.70 and 1.00.72). The vulnerability resides in an unspecified function within the /EXCU_SHELL component and allows unauthenticated remote attackers to bypass authentication. Public exploit code is available, heightening the risk of exploitation.

Impact

Successful exploitation allows for improper authentication, which may grant unauthorized access to the device management interface. Given the CVSS 9.8 score, this access can likely lead to full device compromise.

Recommendation

Upgrade Intelbras SG 2404 PoE L2+ firmware to version 1.00.74 or later immediately.
Restrict access to the device web management interface to trusted internal networks only.
Audit network logs for unauthorized access attempts targeting the /EXCU_SHELL path.

Immediate actions

Patch Intelbras SG 2404 PoE L2+ switches to version 1.00.74

IT Operations 24h

Threat Hunt

Identify HTTP requests targeting /EXCU_SHELL on Intelbras switches

T1190 high high confidence hunt now

Data: Web server access logs, Network firewall logs

Mitigations

Upgrade firmware to 1.00.74

immediate IT Operations

CVE-2026-124577