CVE-2021-30166

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission...

CVE-2021-30166

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission...

Command injection

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission...

CVE-2021-30169 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential...

CVE-2021-30168 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices...

CVE-2021-30166 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission...

CVE-2021-30166

CVE-2021-30166 affects Meri t Lilin IP cameras (MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 series). The root cause is the NTP Server configuration function not being verified with special parameters, enabling a remote attacker with privileged access to perform a command injection and execute arbitrary ...

CVE-2021-30166: Improper Neutralization of Special Elements used in an OS Command

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission...

PT-2021-18640

Name of the Vulnerable Software and Affected Versions IP camera device affected versions not specified Description The issue concerns the NTP Server configuration function of the IP camera device, which does not properly verify special parameters. This allows remote attackers to perform a command...

CVE-2020-19639

Cross Site Request Forgery CSRF vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI...

CVE-2020-19643

Cross Site Scripting XSS vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page...

CVE-2020-19642

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the 'recdata.db' file to call a specially crafted GoAhead ASP-file on the SD card...

Cross site scripting

Cross Site Scripting XSS vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page...

Design/Logic Flaw

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the 'recdata.db' file to call a specially crafted GoAhead ASP-file on the SD card...

CVE-2020-19643

CVE-2020-19643 affects the INSMA Wifi Mini Spy 1080P HD Security IP Camera (firmware version 1.9.7 B). The issue is a Cross-Site Scripting (XSS) vulnerability that originates from inputs in the FTP settings page, exploitable through the goform/formSetFtpCfg endpoint. The CVSS data indicates a net...

CVE-2020-19642

Affected product: INSMA Wifi Mini Spy 1080P HD Security IP Camera (firmware version 1.9.7 B). Vulnerability: Local arbitrary code execution via editing the ‘recdata.db’ file to call a specially crafted GoAhead ASP-file stored on the SD card. Root cause / vector (as described): The GoAhead ASP-fil...

CVE-2020-19642

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the 'recdata.db' file to call a specially crafted GoAhead ASP-file on the SD card...

CVE-2020-19641

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'...

CVE-2020-19641

CVE-2020-19641 affects INSMA Wifi Mini Spy 1080P HD Security IP Camera, firmware version 1.9.7 B. Authenticated attackers with the Operator privilege can escalate to admin by sending a crafted request to /goform/formUserMng . The connected documents corroborate administrator-privilege escalation ...

CVE-2020-19640

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to '/media/?action=cmd'...