Skip to main content

P2R8852E2 Firmware CVE-2021-30166

HIGH
OS Command Injection (CWE-78)
2021-04-28 twcert@cert.org.tw
Command Injection P2R8852E2 Firmware P2R8852E4 Firmware P2R6852E2 Firmware P2R6852E4 Firmware P2R6552E2 Firmware P2R6552E4 Firmware P2R6352Ae2 Firmware P2R6352Ae4 Firmware P2R3052Ae2 Firmware P2G1052 Firmware P2R8822E2 Firmware P2R8822E4 Firmware P2R6822E2 Firmware P2R6822E4 Firmware P2R6522E2 Firmware P2R6522E4 Firmware P2R6322Ae2 Firmware P2R6322Ae4 Firmware P2R3022Ae2 Firmware P2G1022 Firmware P2G1022X Firmware Z2R8852Ax Firmware Z2R8152X P Firmware Z2R8152X2 P Firmware Z2R8052Ex25 Firmware Z2R6552X Firmware Z2R6452Ax Firmware Z2R6452Ax P Firmware Z2R8822Ax Firmware Z2R8122X P Firmware Z2R8122X2 P Firmware Z2R8022Ex25 Firmware Z2R6522X Firmware Z2R6422Ax Firmware Z2R6422Ax P Firmware P3R6322E2 Firmware P3R6522E2 Firmware P3R8822E2 Firmware Z3R6422X3 Firmware Z3R6522X Firmware Z3R8922X3 Firmware
7.2
CVSS 3.1 · Vendor: cert
Share

Severity by source

Vendor (cert) PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 28, 2021 - 10:15 cve.org
HIGH 7.2

DescriptionCVE.org

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.

AnalysisAI

The NTP Server configuration function of the IP camera device is not verified with special parameters. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission. Affected products include: Meritlilin P2R8852E2 Firmware, Meritlilin P2R8852E4 Firmware, Meritlilin P2R6852E2 Firmware, Meritlilin P2R6852E4 Firmware, Meritlilin P2R6552E2 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.

More in P2R8852E2 Firmware

View all
CVE-2021-30168 CRITICAL
9.8 Apr 28

The sensitive information of webcam device is not properly protected. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2021-30167 CRITICAL
9.8 Apr 28

The manage users profile services of the network camera device allows an authenticated. Rated critical severity (CVSS 9.
CVE-2021-30169 HIGH
7.5 Apr 28

The sensitive information of webcam device is not properly protected. Rated high severity (CVSS 7.5), this vulnerability

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2021-30166 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy