The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jun/0 | Exploit Mailing List Third Party Advisory |
| https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt | Exploit Third Party Advisory |
| http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jun/0 | Exploit Mailing List Third Party Advisory |
| https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 06:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2022/Jun/0 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt - Exploit, Third Party Advisory |
Information
Published : 2022-07-17 22:15
Updated : 2024-11-21 06:23
NVD link : CVE-2021-40149
Mitre link : CVE-2021-40149
CVE.ORG link : CVE-2021-40149
JSON object : View
Products Affected
reolink
- e1_zoom_firmware
- e1_zoom
CWE
CWE-552
Files or Directories Accessible to External Parties