CVE-2021-40380: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials.

PriorityP267high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

22.72%

97.4th percentile

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
comprotech	ip570_firmware	—	—
comprotech	ip70_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/cameralist/cameralist.cgi↗

path/cgi-bin/cameralist/setcamera.cgi?id=*↗

→Monitor HTTP requests to cameralist.cgi and setcamera.cgi endpoints without authentication — these paths disclose device administrator and RTSP credentials when accessed unauthenticated. ↗
→Alert on unauthenticated GET requests targeting /cgi-bin/cameralist/setcamera.cgi with a wildcard or any value for the 'id' parameter, as this is the exploit payload pattern. ↗
→Affected devices include Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 — scope detection rules to these device fingerprints. ↗

·The vulnerability is an unauthorized access issue — no authentication bypass payload is needed; a plain HTTP GET to the disclosed paths is sufficient to retrieve credentials. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.