CVE-2021-40149

published 2022-07-17

CVE-2021-40149: The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download…

Priority P3 46 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C H I N A N

EXPLOIT

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
reolink	e1_zoom_firmware	<= 3.0.0.716	—

Detection & IOCs extracted from sources · hover to see the quote

path /self.key↗

other shodan-query: http.title:"Reolink"

other fofa-query: title="reolink"

yara

regex: '(?m)^-----BEGIN PRIVATE KEY-----'

• → Send an unauthenticated HTTP GET request to /self.key on the target device; a 200 response whose body begins with '-----BEGIN PRIVATE KEY-----' confirms the SSL private key is publicly exposed.
• → Confirm the response is not JSON/HTML (negative match on Content-Type: application/json or application/html) to reduce false positives when matching the private key body.
• → Use Shodan, FOFA, or Google to identify exposed Reolink E1 Zoom cameras as targets for this vulnerability.

• · Vulnerability affects Reolink E1 Zoom Camera firmware versions 3.0.0.716 and below only.
• · The private key is served directly from the root web server directory with no authentication required, making exploitation trivially easy from the network. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-552