263 lines
11 KiB
JSON
263 lines
11 KiB
JSON
{
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"product": "P2/Z2/P3/Z3 IP camera firmware",
|
||
"vendor": "MERIT LILIN ENT.CO.,LTD.",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "7.1.94.8908",
|
||
"status": "affected",
|
||
"version": "unspecified",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"datePublic": "2021-04-28T00:00:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 9.8,
|
||
"baseSeverity": "CRITICAL",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-522",
|
||
"description": "CWE-522 Insufficiently Protected Credentials",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"dateUpdated": "2021-04-28T09:30:43.000Z",
|
||
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
|
||
"shortName": "twcert"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "TVN-202104003",
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"x_legacyV4Record": {
|
||
"CVE_data_meta": {
|
||
"AKA": "TWCERT/CC",
|
||
"ASSIGNER": "cve@cert.org.tw",
|
||
"DATE_PUBLIC": "2021-04-28T09:08:00.000Z",
|
||
"ID": "CVE-2021-30167",
|
||
"STATE": "PUBLIC",
|
||
"TITLE": "MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication"
|
||
},
|
||
"affects": {
|
||
"vendor": {
|
||
"vendor_data": [
|
||
{
|
||
"product": {
|
||
"product_data": [
|
||
{
|
||
"product_name": "P2/Z2/P3/Z3 IP camera firmware",
|
||
"version": {
|
||
"version_data": [
|
||
{
|
||
"version_affected": "<=",
|
||
"version_value": "7.1.94.8908"
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"vendor_name": "MERIT LILIN ENT.CO.,LTD."
|
||
}
|
||
]
|
||
}
|
||
},
|
||
"data_format": "MITRE",
|
||
"data_type": "CVE",
|
||
"data_version": "4.0",
|
||
"description": {
|
||
"description_data": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices."
|
||
}
|
||
]
|
||
},
|
||
"generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"impact": {
|
||
"cvss": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 9.8,
|
||
"baseSeverity": "CRITICAL",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
}
|
||
},
|
||
"problemtype": {
|
||
"problemtype_data": [
|
||
{
|
||
"description": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "CWE-522 Insufficiently Protected Credentials"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"references": {
|
||
"reference_data": [
|
||
{
|
||
"name": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html",
|
||
"refsource": "MISC",
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
|
||
},
|
||
{
|
||
"name": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf",
|
||
"refsource": "MISC",
|
||
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
|
||
},
|
||
{
|
||
"name": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e",
|
||
"refsource": "MISC",
|
||
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
|
||
},
|
||
{
|
||
"name": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388",
|
||
"refsource": "MISC",
|
||
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
|
||
}
|
||
]
|
||
},
|
||
"solution": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Update P2/Z2/P3/Z3 IP camera firmware to SVN9695."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "TVN-202104003",
|
||
"discovery": "EXTERNAL"
|
||
}
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-03T22:24:59.549Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"cveMetadata": {
|
||
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
|
||
"assignerShortName": "twcert",
|
||
"cveId": "CVE-2021-30167",
|
||
"datePublished": "2021-04-28T09:30:44.048Z",
|
||
"dateReserved": "2021-04-06T00:00:00.000Z",
|
||
"dateUpdated": "2024-09-17T02:32:23.031Z",
|
||
"state": "PUBLISHED"
|
||
},
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1"
|
||
} |