CVE-2021-40149

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Jun/0Exploit, Mailing List, Third Party Advisory
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Jun/0Exploit, Mailing List, Third Party Advisory
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txtExploit, Third Party Advisory

Timeline

Published: Jul 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-40154.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-401507.5The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly acc CVE-2021-401538.1squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create CVE-2021-401545.5NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of U CVE-2021-401557.8A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing CVE-2021-401567.8A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated boundaries when parsing CVE-2021-401577.8A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review ver CVE-2021-401587.8A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries CVE-2021-401597.8An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities m CVE-2021-40163.3Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snap CVE-2021-401607.8PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file. This vulnerabi CVE-2021-401617.8A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 versio