CVE-2021-30167

Katalog CVE

CVSS 9.8 · Critical EPSS 2,4%

Kerentanan Insufficiently Protected Credentials pada meritlilin p2r8852e2 firmware, meritlilin p2r8852e4 firmware +39 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut cert.org.tw.

Deskripsi (NVD)

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.

Rincian

Terbit di NVD

28 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber cert.org.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf advisory vendor
• https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e advisory pihak ketiga
• https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388 advisory pihak ketiga
• https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html not applicable