high7.2
CVE-2021-30166
The NTP Server configuration function of the IP camera device is not verified with special parameters.
Impact
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Meritlilin | P2r8852e2 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r8852e4 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r6852e2 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r6852e4 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r6552e2 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r6552e4 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r6352ae2 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r6352ae4 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r3052ae2 Firmware | before 7.1.94.8908 |
| Meritlilin | P2g1052 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r8822e2 Firmware | before 7.1.94.8908 |
| Meritlilin | P2r8822e4 Firmware | before 7.1.94.8908 |
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e
- https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388
- https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
- https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html
- https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e
- https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388
- https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
- https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html