Search
Find a vulnerability
Search criteria
8 vulnerabilities by MERIT LILIN ENT.CO.,LTD.
CVE-2021-30169 (GCVE-0-2021-30169)
Vulnerability from nvd – Published: 2021-04-28 09:30 – Updated: 2024-09-17 01:46
VLAI
Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2
Summary
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
Severity
5.3 (Medium)
CWE
- CWE-200 - Information Exposure
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.669Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user\u2019s credential."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:45.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104005",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30169",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user\u2019s credential."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30169",
"datePublished": "2021-04-28T09:30:45.489Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:46:06.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30168 (GCVE-0-2021-30168)
Vulnerability from nvd – Published: 2021-04-28 09:30 – Updated: 2024-09-16 20:48Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1
Summary
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.
Severity
9.8 (Critical)
CWE
- CWE-200 - Information Exposure
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator\u2019s credential and further control the devices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:44.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104004",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30168",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator\u2019s credential and further control the devices."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30168",
"datePublished": "2021-04-28T09:30:44.741Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:48:03.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30167 (GCVE-0-2021-30167)
Vulnerability from nvd – Published: 2021-04-28 09:30 – Updated: 2024-09-17 02:32
VLAI
Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication
Summary
The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.
Severity
9.8 (Critical)
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html | x_refsource_MISC |
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.549Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user\u2019s information and escalate privileges to control the devices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:43.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104003",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30167",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user\u2019s information and escalate privileges to control the devices."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-522 Insufficiently Protected Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30167",
"datePublished": "2021-04-28T09:30:44.048Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:32:23.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30166 (GCVE-0-2021-30166)
Vulnerability from nvd – Published: 2021-04-28 09:30 – Updated: 2024-09-17 03:43
VLAI
Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection
Summary
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
Severity
7.2 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html | x_refsource_MISC |
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.684Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:43.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104002",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30166",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104002",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30166",
"datePublished": "2021-04-28T09:30:43.337Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:43:51.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30169 (GCVE-0-2021-30169)
Vulnerability from cvelistv5 – Published: 2021-04-28 09:30 – Updated: 2024-09-17 01:46
VLAI
Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2
Summary
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
Severity
5.3 (Medium)
CWE
- CWE-200 - Information Exposure
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.669Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user\u2019s credential."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:45.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104005",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30169",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user\u2019s credential."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30169",
"datePublished": "2021-04-28T09:30:45.489Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:46:06.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30168 (GCVE-0-2021-30168)
Vulnerability from cvelistv5 – Published: 2021-04-28 09:30 – Updated: 2024-09-16 20:48Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1
Summary
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.
Severity
9.8 (Critical)
CWE
- CWE-200 - Information Exposure
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator\u2019s credential and further control the devices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:44.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104004",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30168",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator\u2019s credential and further control the devices."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30168",
"datePublished": "2021-04-28T09:30:44.741Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:48:03.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30167 (GCVE-0-2021-30167)
Vulnerability from cvelistv5 – Published: 2021-04-28 09:30 – Updated: 2024-09-17 02:32
VLAI
Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication
Summary
The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.
Severity
9.8 (Critical)
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html | x_refsource_MISC |
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.549Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user\u2019s information and escalate privileges to control the devices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:43.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104003",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30167",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user\u2019s information and escalate privileges to control the devices."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-522 Insufficiently Protected Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30167",
"datePublished": "2021-04-28T09:30:44.048Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:32:23.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30166 (GCVE-0-2021-30166)
Vulnerability from cvelistv5 – Published: 2021-04-28 09:30 – Updated: 2024-09-17 03:43
VLAI
Title
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection
Summary
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
Severity
7.2 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html | x_refsource_MISC |
| https://www.meritlilin.com/assets/uploads/support… | x_refsource_MISC |
| https://gist.github.com/keniver/86ebef688fb274b53… | x_refsource_MISC |
| https://www.chtsecurity.com/news/0b733a38-e616-4f… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware |
Affected:
unspecified , ≤ 7.1.94.8908
(custom)
|
Date Public
2021-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.684Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P2/Z2/P3/Z3 IP camera firmware",
"vendor": "MERIT LILIN ENT.CO.,LTD.",
"versions": [
{
"lessThanOrEqual": "7.1.94.8908",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-28T09:30:43.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
],
"solutions": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104002",
"discovery": "EXTERNAL"
},
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
"ID": "CVE-2021-30166",
"STATE": "PUBLIC",
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.1.94.8908"
}
]
}
}
]
},
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
},
{
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
"refsource": "MISC",
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
},
{
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
"refsource": "MISC",
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
},
{
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
}
],
"source": {
"advisory": "TVN-202104002",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-30166",
"datePublished": "2021-04-28T09:30:43.337Z",
"dateReserved": "2021-04-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:43:51.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}