CVE-2021-4469

HighCVSS 8.7/10Last modified Oct 12, 2026

Description

Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the primary web interface on port 80 enforces authentication, the backdoor service allows any remote attacker to retrieve image snapshots by directly requesting the 'snapshot' endpoint. An attacker can repeatedly collect snapshots and reconstruct the camera stream, compromising the confidentiality of the monitored environment.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-306 CWE-1242

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2025
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-446925.3BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a CVE-2021-446934.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446945.5Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446954.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446965.5Adobe Prelude version 22.1.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive mem CVE-2021-446973.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446983.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446993.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-44709.3TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is p CVE-2021-447005.5Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead CVE-2021-447017.8Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-CVE-2021-447024.3Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affecte