CVE-2021-21301 - CVE House
Back to Database
Status published Low CVE-2021-21301

Video feed was captured while user has disabled video

Vulnerability Description

Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21301

Credits & Attribution

No credits recorded in the NVD database.

References

More from wireapp

View All →
CVE-2025-49846
wire-ios accidentally logs message contents
Medium 4.1
CVE-2025-48066
wire-webapp has no database deletion on client logout
Medium 6
CVE-2025-48061
wire-webapp Has Insufficient Session Invalidation after User Logout
Medium 5.6
CVE-2023-48221
wire-avs remote format string vulnerability
High 7.3
CVE-2023-22737
wire-server vulnerable to unauthorized removal of Bots from Conversations
Medium 6.5

Affected Vendor

Affected Software

wire-ios
Vulnerable Versions:
< 3.75

Timeline

Official Publish: February 11th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration