CVE-2021-30167

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication

Description

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.

Remediation

Solution:

  • Update P2/Z2/P3/Z3 IP camera firmware to SVN9695.

Categories

9.8
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 3.02% Top 15%
Vendor Advisory meritlilin.com
Affected: MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware
Published at:
Updated at:

References

Link Tags
https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html not applicable
https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf vendor advisory
https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e third party advisory
https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388 third party advisory

Frequently Asked Questions

What is the severity of CVE-2021-30167?
CVE-2021-30167 has been scored as a critical severity vulnerability.
How to fix CVE-2021-30167?
To fix CVE-2021-30167: Update P2/Z2/P3/Z3 IP camera firmware to SVN9695.
Is CVE-2021-30167 being actively exploited in the wild?
It is possible that CVE-2021-30167 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-30167?
CVE-2021-30167 affects MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.