MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2

published 2021-04-28 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-17105

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.

Patch / fix

fixed in 20

meritlilin p2r8852e2_firmware 7.1.94.8908
meritlilin p2r8852e4_firmware 7.1.94.8908
meritlilin p2r6852e2_firmware 7.1.94.8908
meritlilin p2r6852e4_firmware 7.1.94.8908
meritlilin p2r6552e2_firmware 7.1.94.8908
meritlilin p2r6552e4_firmware 7.1.94.8908
meritlilin p2r6352ae2_firmware 7.1.94.8908
meritlilin p2r6352ae4_firmware 7.1.94.8908
meritlilin p2r3052ae2_firmware 7.1.94.8908
meritlilin p2g1052_firmware 7.1.94.8908
meritlilin p2r8822e2_firmware 7.1.94.8908
meritlilin p2r8822e4_firmware 7.1.94.8908
meritlilin p2r6822e2_firmware 7.1.94.8908
meritlilin p2r6822e4_firmware 7.1.94.8908
meritlilin p2r6522e2_firmware 7.1.94.8908
meritlilin p2r6522e4_firmware 7.1.94.8908
meritlilin p2r6322ae2_firmware 7.1.94.8908
meritlilin p2r6322ae4_firmware 7.1.94.8908
meritlilin p2r3022ae2_firmware 7.1.94.8908
meritlilin p2g1022_firmware 7.1.94.8908

Exploit prediction

1.68% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 Insufficiently Protected Credentials

References

meritlilin.com /assets/uploads/support/file/M00166-TW.pdf
vendor-advisory
gist.github.com /keniver/86ebef688fb274b534da51ef1a84dd3e
third-party-advisory
chtsecurity.com /news/0b733a38-e616-4ff3-86a6-13e710643388
third-party-advisory
twcert.org.tw /tw/cp-132-4679-d308c-1.html
third-party-advisory

Sources

CVE List CVE-2021-30169
NVD CVE-2021-30169

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary