MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1

published 2021-04-28 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-17104

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.1%; EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits: 0; none known

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.

Patch / fix

fixed in 20

meritlilin p2r8852e2_firmware 7.1.94.8908
meritlilin p2r8852e4_firmware 7.1.94.8908
meritlilin p2r6852e2_firmware 7.1.94.8908
meritlilin p2r6852e4_firmware 7.1.94.8908
meritlilin p2r6552e2_firmware 7.1.94.8908
meritlilin p2r6552e4_firmware 7.1.94.8908
meritlilin p2r6352ae2_firmware 7.1.94.8908
meritlilin p2r6352ae4_firmware 7.1.94.8908
meritlilin p2r3052ae2_firmware 7.1.94.8908
meritlilin p2g1052_firmware 7.1.94.8908
meritlilin p2r8822e2_firmware 7.1.94.8908
meritlilin p2r8822e4_firmware 7.1.94.8908
meritlilin p2r6822e2_firmware 7.1.94.8908
meritlilin p2r6822e4_firmware 7.1.94.8908
meritlilin p2r6522e2_firmware 7.1.94.8908
meritlilin p2r6522e4_firmware 7.1.94.8908
meritlilin p2r6322ae2_firmware 7.1.94.8908
meritlilin p2r6322ae4_firmware 7.1.94.8908
meritlilin p2r3022ae2_firmware 7.1.94.8908
meritlilin p2g1022_firmware 7.1.94.8908

Exploit prediction

2.08% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 Insufficiently Protected Credentials

References

meritlilin.com /assets/uploads/support/file/M00166-TW.pdf
vendor-advisory
gist.github.com /keniver/86ebef688fb274b534da51ef1a84dd3e
third-party-advisory
chtsecurity.com /news/0b733a38-e616-4ff3-86a6-13e710643388
third-party-advisory
twcert.org.tw /tw/cp-132-4678-aad70-1.html
third-party-advisory

Sources

CVE List CVE-2021-30168
NVD CVE-2021-30168

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary