Lucene search

TwcertCVELIST:CVE-2021-30166

HistoryApr 28, 2021 - 9:30 a.m.

CVE-2021-30166 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection

2021-04-2809:30:43

CWE-78

twcert

www.cve.org

ip camera

command injection

ntp server configuration

remote attackers

privileged permission

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.016

Percentile

87.6%

JSON

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.

CNA Affected

[
  {
    "product": "P2/Z2/P3/Z3 IP camera firmware",
    "vendor": "MERIT LILIN ENT.CO.,LTD.",
    "versions": [
      {
        "lessThanOrEqual": "7.1.94.8908",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e

www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388

www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf

www.twcert.org.tw/tw/cp-132-4676-391a5-1.html

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.016

Percentile

87.6%

JSON

Related for CVELIST:CVE-2021-30166