What is the CVSS score of CVE-2021-30167?

CVE-2021-30167 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.4%.

P2R8852E2 Firmware CVE-2021-30167

CRITICAL

Insufficiently Protected Credentials (CWE-522)

2021-04-28 twcert@cert.org.tw

Privilege Escalation P2R8852E2 Firmware P2R8852E4 Firmware P2R6852E2 Firmware P2R6852E4 Firmware P2R6552E2 Firmware P2R6552E4 Firmware P2R6352Ae2 Firmware P2R6352Ae4 Firmware P2R3052Ae2 Firmware P2G1052 Firmware P2R8822E2 Firmware P2R8822E4 Firmware P2R6822E2 Firmware P2R6822E4 Firmware P2R6522E2 Firmware P2R6522E4 Firmware P2R6322Ae2 Firmware P2R6322Ae4 Firmware P2R3022Ae2 Firmware P2G1022 Firmware P2G1022X Firmware Z2R8852Ax Firmware Z2R8152X P Firmware Z2R8152X2 P Firmware Z2R8052Ex25 Firmware Z2R6552X Firmware Z2R6452Ax Firmware Z2R6452Ax P Firmware Z2R8822Ax Firmware Z2R8122X P Firmware Z2R8122X2 P Firmware Z2R8022Ex25 Firmware Z2R6522X Firmware Z2R6422Ax Firmware Z2R6422Ax P Firmware P3R6322E2 Firmware P3R6522E2 Firmware P3R8822E2 Firmware Z3R6422X3 Firmware Z3R6522X Firmware Z3R8922X3 Firmware

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Apr 28, 2021 - 10:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.

AnalysisAI

The manage users profile services of the network camera device allows an authenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices. Affected products include: Meritlilin P2R8852E2 Firmware, Meritlilin P2R8852E4 Firmware, Meritlilin P2R6852E2 Firmware, Meritlilin P2R6852E4 Firmware, Meritlilin P2R6552E2 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.