cbcvebase.
CVE-2021-40381
published 2021-09-01

CVE-2021-40381: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access.

PriorityP266high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
22.72%
97.4th percentile
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access.

Affected

2 ranges
VendorProductVersion rangeFixed in
comprotechip570_firmware——
comprotechip70_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/view/index_MJpeg.cgi↗
  • →Detect unauthenticated HTTP GET requests to the vulnerable CGI endpoint /cgi-bin/view/index_MJpeg.cgi on Compro IP camera devices, which exposes the live MJPEG video stream without authentication. ↗
  • →Flag any access to index_MJpeg.cgi on Compro IP70, IP570, IP60, or TN540 devices — particularly from external/untrusted sources — as potential unauthorized video stream disclosure. ↗
  • ·Affected versions are specifically Compro IP70 2.08_7130218 and IP570 2.08_7130520; IP60 and TN540 version strings are not specified in the advisory. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.