CVE-2021-40149

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.

CVSS v3.1

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

7.44% chance of exploitation in the next 30 days, 94th percentile

Nuclei

medium · CWE-552

Published

2022-07-17

Updated

2024-08-04

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40149.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-40146
• CVE-2021-4015
• CVE-2021-40145
• CVE-2021-40150
• CVE-2021-40113
• CVE-2021-40153