Lucene search

KrcertCVE-2021-26627

HistoryApr 19, 2022 - 9:15 p.m.

CVE-2021-26627

2022-04-1921:15:12

CWE-287

CWE-284

krcert

web.nvd.nist.gov

cve-2021-26627

real-time

image

information

exposure

rtsp

port

authentication

vulnerability

remote attackers

ffplay command

image leakage

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

65.2%

JSON

Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to send the RTSP requests using ffplay command and lead to leakage a live image.

Affected configurations

Nvd

Node

qcpqcp200w_firmwareMatch-android

qcpqcp200w_firmwareMatch-windows

AND

qcpqcp200wMatch-

VendorProductVersionCPE
qcpqcp200w_firmware-cpe:2.3:o:qcp:qcp200w_firmware:-:*:*:*:*:android:*:*
qcpqcp200w_firmware-cpe:2.3:o:qcp:qcp200w_firmware:-:*:*:*:*:windows:*:*
qcpqcp200w-cpe:2.3:h:qcp:qcp200w:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qcp	qcp200w_firmware	-	cpe:2.3:o:qcp:qcp200w_firmware:-:::::android::
qcp	qcp200w_firmware	-	cpe:2.3:o:qcp:qcp200w_firmware:-:::::windows::
qcp	qcp200w	-	cpe:2.3:h:qcp:qcp200w:-:::::::*

CNA Affected

[
  {
    "platforms": [
      "Windows, Android"
    ],
    "product": "QCP 200W",
    "vendor": "EDrhyme Co.,Ltd",
    "versions": [
      {
        "status": "affected",
        "version": "No version information"
      }
    ]
  }
]

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66663

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

65.2%

JSON

Related for CVE-2021-26627