Vulnerability · Published Apr 28, 2021 · Assigned by twcert
CVE-2021-30166MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection
High 7.2
In plain English
A high-severity OS command injection in P2/Z2/P3/Z3 IP camera firmware from MERIT LILIN ENT.CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)3.8%top 10.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MERIT LILIN ENT.CO.,LTD. | P2/Z2/P3/Z3 IP camera firmware | unspecified – through 7.1.94.8908 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html x_refsource_MISC
- https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf x_refsource_MISC
- https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e x_refsource_MISC
- https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388 x_refsource_MISC