The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jun/0 | Exploit Mailing List Third Party Advisory |
| https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
27 Jul 2022, 17:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html - Exploit, Third Party Advisory, VDB Entry | |
| References | (MISC) http://seclists.org/fulldisclosure/2022/Jun/0 - Exploit, Mailing List, Third Party Advisory | |
| References | (MISC) https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt - Exploit, Third Party Advisory | |
| First Time |
Reolink e1 Zoom
Reolink e1 Zoom Firmware Reolink |
|
| CWE | CWE-552 | |
| CPE | cpe:2.3:o:reolink:e1_zoom_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:reolink:e1_zoom:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
17 Jul 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-17 22:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-40149
Mitre link : CVE-2021-40149
CVE.ORG link : CVE-2021-40149
JSON object : View
Products Affected
reolink
- e1_zoom_firmware
- e1_zoom
CWE
CWE-552
Files or Directories Accessible to External Parties