CVE-2021-40149

Published: Jul 17, 2022Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.

Affected (1)

Products: Reolink: E1 Zoom Firmware

Reolink

1 product

E1 Zoom Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink E1 Zoom Firmware	Up to 3.0.0.716

Running on/with	Platform Versions
Reolink E1 Zoom	All versions

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (6)

http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2022/Jun/0

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2022/Jun/0

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.