CVE-2021-30169 : The sensitive information of webcam device is not properly protected. Remote att

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.

Published 2021-04-28 10:15:09

Updated 2022-10-25 19:07:32

Source TWCERT/CC

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2021-30169

Meritlilin » P2r8852e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r8852e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r8852e2 » Version: N/A
Meritlilin » P2r8852e4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r8852e4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r8852e4 » Version: N/A
Meritlilin » P2r6852e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6852e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6852e2 » Version: N/A
Meritlilin » P2r6852e4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6852e4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6852e4 » Version: N/A
Meritlilin » P2r6552e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6552e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6552e2 » Version: N/A
Meritlilin » P2r6552e4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6552e4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6552e4 » Version: N/A
Meritlilin » P2r6352ae2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6352ae2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6352ae2 » Version: N/A
Meritlilin » P2r6352ae4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6352ae4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6352ae4 » Version: N/A
Meritlilin » P2r3052ae2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r3052ae2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r3052ae2 » Version: N/A
Meritlilin » P2g1052 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2g1052_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2g1052 » Version: N/A
Meritlilin » P2r8822e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r8822e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r8822e2 » Version: N/A
Meritlilin » P2r8822e4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r8822e4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r8822e4 » Version: N/A
Meritlilin » P2r6822e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6822e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6822e2 » Version: N/A
Meritlilin » P2r6822e4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6822e4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6822e4 » Version: N/A
Meritlilin » P2r6522e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6522e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6522e2 » Version: N/A
Meritlilin » P2r6522e4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6522e4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6522e4 » Version: N/A
Meritlilin » P2r6322ae2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6322ae2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6322ae2 » Version: N/A
Meritlilin » P2r6322ae4 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r6322ae4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r6322ae4 » Version: N/A
Meritlilin » P2r3022ae2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2r3022ae2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2r3022ae2 » Version: N/A
Meritlilin » P2g1022 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2g1022_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2g1022 » Version: N/A
Meritlilin » P2g1022x Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p2g1022x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P2g1022x » Version: N/A
Meritlilin » Z2r8852ax Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8852ax_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8852ax » Version: N/A
Meritlilin » Z2r8152x-p Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8152x-p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8152x-p » Version: N/A
Meritlilin » Z2r8152x2-p Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8152x2-p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8152x2-p » Version: N/A
Meritlilin » Z2r8052ex25 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8052ex25_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8052ex25 » Version: N/A
Meritlilin » Z2r6552x Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r6552x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r6552x » Version: N/A
Meritlilin » Z2r6452ax Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r6452ax_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r6452ax » Version: N/A
Meritlilin » Z2r6452ax-p Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r6452ax-p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r6452ax-p » Version: N/A
Meritlilin » Z2r8822ax Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8822ax_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8822ax » Version: N/A
Meritlilin » Z2r8122x-p Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8122x-p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8122x-p » Version: N/A
Meritlilin » Z2r8122x2-p Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8122x2-p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8122x2-p » Version: N/A
Meritlilin » Z2r8022ex25 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r8022ex25_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r8022ex25 » Version: N/A
Meritlilin » Z2r6522x Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r6522x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r6522x » Version: N/A
Meritlilin » Z2r6422ax Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r6422ax_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r6422ax » Version: N/A
Meritlilin » Z2r6422ax-p Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z2r6422ax-p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z2r6422ax-p » Version: N/A
Meritlilin » P3r6322e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p3r6322e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P3r6322e2 » Version: N/A
Meritlilin » P3r6522e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p3r6522e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P3r6522e2 » Version: N/A
Meritlilin » P3r8822e2 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:p3r8822e2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » P3r8822e2 » Version: N/A
Meritlilin » Z3r6422x3 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z3r6422x3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z3r6422x3 » Version: N/A
Meritlilin » Z3r6522x Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z3r6522x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z3r6522x » Version: N/A
Meritlilin » Z3r8922x3 Firmware
Versions before (<) 7.1.94.8908
cpe:2.3:o:meritlilin:z3r8922x3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Meritlilin » Z3r8922x3 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-30169

EPSS FAQ

1.02%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-30169

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	TWCERT/CC
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2021-30169

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: twcert@cert.org.tw (Secondary)
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-30169

https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388

CHT Security Red Team Discovered Several Vulnerabilities in Well-Known IP Camera｜中華資安國際 CHT Security Co., Ltd.
Third Party Advisory

CVEs referencing this url
https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf

Vendor Advisory

CVEs referencing this url
https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e

LILIN IP Camera P2 Z2 Multiple Vulnerabilities.md · GitHub
Third Party Advisory

CVEs referencing this url
https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html

TWCERT/CC台灣電腦網路危機處理暨協調中心-利凌企業 P2/Z2/P3/Z3系列網路攝影機 - Sensitive Data Exposure-2
Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-30169

Products affected by CVE-2021-30169

Exploit prediction scoring system (EPSS) score for CVE-2021-30169

CVSS scores for CVE-2021-30169

CWE ids for CVE-2021-30169

References for CVE-2021-30169