Details of VAR-202108-0687

ID

VAR-202108-0687

CVE

CVE-2021-3616

TITLE

plural Lenovo Smart Camera Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-011045

DESCRIPTION

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651. (DoS) It may be in a state. Shenzhen Qiaoan Technology Co., Ltd. is a professional R&D and manufacturer of surveillance cameras, specializing in the production of Qiaoan surveillance, Qiaoan surveillance cameras, etc. Several webcams of Shenzhen Qiaoan Technology Co., Ltd. have information disclosure vulnerabilities, which can be exploited by attackers to obtain sensitive information

Trust: 2.25

sources: NVD: CVE-2021-3616 // JVNDB: JVNDB-2021-011045 // CNVD: CNVD-2020-68651 // VULMON: CVE-2021-3616

AFFECTED PRODUCTS

vendor:	lenovo	model:	smart camera c2e	scope:	lt	version:	01.03.29.16	Trust: 1.0
vendor:	lenovo	model:	smart camera x3	scope:	lt	version:	01.03.29.16	Trust: 1.0
vendor:	lenovo	model:	smart camera x5	scope:	lt	version:	01.03.29.16	Trust: 1.0
vendor:	lenovo	model:	smart camera x5	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	smart camera c2e	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	smart camera x3	scope:	-	version:	-	Trust: 0.8
vendor:	qiaoan	model:	ja-770	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c7m	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c1k	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2t	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2c	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-g4r	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2t-l	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q7m	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q7	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f8	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2e	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q10	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q3	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c10	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2t-n	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q13c	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f10	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c10e	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2r	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q3r	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c6k	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2k	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q7k	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-f2k-4x	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c5	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q8	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c9	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q5	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-a6	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-q7r	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-g4c	scope:	eq	version:	01.03.29.14	Trust: 0.6
vendor:	qiaoan	model:	ja-c6	scope:	eq	version:	01.03.29.14	Trust: 0.6

sources: CNVD: CNVD-2020-68651 // JVNDB: JVNDB-2021-011045 // NVD: CVE-2021-3616

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-3616
value:	CRITICAL
Trust: 1.0
psirt@lenovo.com:	CVE-2021-3616
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2021-3616
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2020-68651
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202108-1581
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2021-3616
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-3616
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-68651
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-3616
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
psirt@lenovo.com:	CVE-2021-3616
baseSeverity:	CRITICAL
baseScore:	9.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.5
version:	3.1
Trust: 1.0
NVD:	CVE-2021-3616
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-68651 // VULMON: CVE-2021-3616 // JVNDB: JVNDB-2021-011045 // CNNVD: CNNVD-202108-1581 // NVD: CVE-2021-3616 // NVD: CVE-2021-3616

PROBLEMTYPE DATA

problemtype:	CWE-285	Trust: 1.0
problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	others (CWE-Other) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-011045 // NVD: CVE-2021-3616

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-1581

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202108-1581

PATCH

title:	LEN-49262	url:	https://iknow.lenovo.com.cn/detail/dc_198417.html	Trust: 0.8
title:	Lenovo Smart Camera Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=160996	Trust: 0.6

sources: JVNDB: JVNDB-2021-011045 // CNNVD: CNNVD-202108-1581

EXTERNAL IDS

db:	NVD	id:	CVE-2021-3616	Trust: 3.3
db:	CNVD	id:	CNVD-2020-68651	Trust: 2.3
db:	JVNDB	id:	JVNDB-2021-011045	Trust: 0.8
db:	CNNVD	id:	CNNVD-202108-1581	Trust: 0.6
db:	VULMON	id:	CVE-2021-3616	Trust: 0.1

sources: CNVD: CNVD-2020-68651 // VULMON: CVE-2021-3616 // JVNDB: JVNDB-2021-011045 // CNNVD: CNNVD-202108-1581 // NVD: CVE-2021-3616

REFERENCES

url:	https://www.cnvd.org.cn/flaw/show/cnvd-2020-68651	Trust: 1.7
url:	https://iknow.lenovo.com.cn/detail/dc_198417.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-3616	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2021-3616 // JVNDB: JVNDB-2021-011045 // CNNVD: CNNVD-202108-1581 // NVD: CVE-2021-3616

SOURCES

db:	CNVD	id:	CNVD-2020-68651
db:	VULMON	id:	CVE-2021-3616
db:	JVNDB	id:	JVNDB-2021-011045
db:	CNNVD	id:	CNNVD-202108-1581
db:	NVD	id:	CVE-2021-3616

LAST UPDATE DATE

2024-11-23T22:44:09.523000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-68651	date:	2020-12-03T00:00:00
db:	VULMON	id:	CVE-2021-3616	date:	2021-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2021-011045	date:	2022-07-15T04:57:00
db:	CNNVD	id:	CNNVD-202108-1581	date:	2021-08-31T00:00:00
db:	NVD	id:	CVE-2021-3616	date:	2024-11-21T06:21:59.423

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-68651	date:	2021-01-04T00:00:00
db:	VULMON	id:	CVE-2021-3616	date:	2021-08-17T00:00:00
db:	JVNDB	id:	JVNDB-2021-011045	date:	2022-07-15T00:00:00
db:	CNNVD	id:	CNNVD-202108-1581	date:	2021-08-17T00:00:00
db:	NVD	id:	CVE-2021-3616	date:	2021-08-17T17:15:07.533