CVE-2021-30169

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-522

Affected software

Vendor	Product	Versions
MERIT LILIN ENT.CO.,LTD.	P2/Z2/P3/Z3 IP camera firmware	>= unspecified, <= 7.1.94.8908

References

https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3eThird Party Advisory
https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388Third Party Advisory
https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdfVendor Advisory
https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.htmlThird Party Advisory
https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3eThird Party Advisory
https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388Third Party Advisory
https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdfVendor Advisory
https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.htmlThird Party Advisory

Timeline

Published: Apr 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-30177.5The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the CVE-2021-301705.4Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject CVE-2021-301715.4Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious Ja CVE-2021-301725.4Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authent CVE-2021-301736.5Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path in CVE-2021-301745.4RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow re CVE-2021-301759.8ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.CVE-2021-301769.8The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.CVE-2021-301779.8There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs bec CVE-2021-301785.5An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain a CVE-2021-301799.8Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocatio CVE-2021-30189.8ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the