by Kastro
Paper/Archive/CVE-2021-30167

CVE-2021-30167

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware — MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.3.843 × 2016.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.

Affected

ProductAffectedFixed inSource
P2/Z2/P3/Z3 IP camera firmwareunspecified – 7.1.94.8908–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-4676-391a5-1.htmlrefmeritlilin.com/assets/uploads/support/file/M00166-TW.pdfrefgist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3erefchtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388