CVE-2021-30167

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication

State: Published
Severity: 9.8 Critical
Published: Apr 28, 2021
Updated: Sep 17, 2024
Reserved: Apr 6, 2021

Description

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
P2/Z2/P3/Z3 IP camera firmwareMERIT LILIN ENT.CO.,LTD.	7.1.94.8908 and earlierAffected

References

https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html
https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e
https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.