CVE-2021-30166

Katalog CVE

CVSS 7.2 · High EPSS 3,8%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada meritlilin p2r8852e2 firmware, meritlilin p2r8852e4 firmware +39 lainnya. Skor CVSS 3.1 7.2 (High) menurut cert.org.tw.

Deskripsi (NVD)

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.

Rincian

Terbit di NVD

28 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber cert.org.tw
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

3,8% peluang dieksploitasi; lebih tinggi dari 89,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf advisory vendor
• https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e advisory pihak ketiga
• https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388 advisory pihak ketiga
• https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html advisory pihak ketiga