CVE-2021-30167
📋 TL;DR
CVE-2021-30167 is an authentication bypass vulnerability in network camera devices that allows authenticated remote attackers to modify URL parameters and escalate privileges to control devices. This affects network camera systems with vulnerable user profile management services. Attackers can gain administrative control over affected devices.
💻 Affected Systems
- Merit LILIN network camera devices
📦 What is this software?
P2g1022 Firmware by Meritlilin
P2g1022x Firmware by Meritlilin
P2g1052 Firmware by Meritlilin
Z2r6522x Firmware by Meritlilin
Z2r6552x Firmware by Meritlilin
Z3r6522x Firmware by Meritlilin
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to disable security features, access video feeds, modify configurations, and use devices as footholds for network attacks.
Likely Case
Privilege escalation leading to unauthorized administrative access, configuration changes, and potential data exfiltration from camera systems.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and regular monitoring in place.
🎯 Exploit Status
Exploit involves modifying URL parameters in user profile management requests. Requires initial authentication but leads to privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released April 29, 2021
Vendor Advisory: https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
Restart Required: Yes
Instructions:
1. Download latest firmware from Merit LILIN support site. 2. Backup current configuration. 3. Upload firmware via web interface. 4. Apply update and restart device. 5. Verify firmware version post-update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate camera network from critical systems and restrict internet access
Access Control
allImplement strict authentication policies and disable unnecessary user accounts
🧯 If You Can't Patch
- Implement network segmentation to isolate camera devices from critical infrastructure
- Enable logging and monitoring for suspicious authentication and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface. If version is older than April 29, 2021 release, device is vulnerable.Check Version:
Login to camera web interface and navigate to System > Information to view firmware versionVerify Fix Applied:
Verify firmware version shows post-April 29, 2021 release and test user profile modification attempts fail.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login
- User privilege changes in logs
- Unusual URL parameter modifications in web requests
Network Indicators:
- HTTP requests with modified user profile parameters
- Traffic to camera management interfaces from unexpected sources
SIEM Query:
source="camera_logs" AND (event_type="privilege_change" OR url_path="/cgi-bin/manage_user.cgi" AND parameters_modified="true")🔗 References
- https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e
- https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388
- https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
- https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html
- https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e
- https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388
- https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
- https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html
