Medium severity · published Jul 17, 2022
CVE-2021-40149
The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory
5.9
CVSS
8.3%
EPSS
No
On KEV
Description
The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.3% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EZ
E1 Zoom Firmware · Reolink
through 3.0.0.716 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40149
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40149
Exploit
http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html
Exploit
http://seclists.org/fulldisclosure/2022/Jun/0
Exploit
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt
More from E1 Zoom Firmware
7.5
CVE-2021-40150
The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path