CVEvulnerability
CVE-2021-40149
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-07-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-552
Description
The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.
Affected configurations
• reolink e1 zoom firmware (<= 3.0.0.716)
Related
Weakness · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
References
- http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2022/Jun/0 Exploit, Mailing List, Third Party Advisory
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2022/Jun/0 Exploit, Mailing List, Third Party Advisory
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt Exploit, Third Party Advisory