HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2021-40407

CVSS 7.2v3.1pub. 2022-01-28upd. 2025-11-03

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Reolink Rlc 410w

    HW
    Reolink
    all versions

  • Reolink Rlc 410w Firmware

    OS
    Reolink
    3.0.0.136_20121102

CISA KEV — detailsi

Vendori
Reolink
Producti
RLC-410W IP Camera
Added to KEVi
December 18, 2024
Remediation deadline (US Federal)i
January 8, 2025(overdue)
Required action (CISA)i

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

CISA descriptioni

Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 8 stycznia 2025
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2021-40408CRITICAL9.8PL ✓same product

Command injection w ustawieniach sieciowych Reolink RLC-410W

CVE-2021-40409CRITICAL9.8PL ✓same product

Command injection w ustawieniach sieciowych Reolink RLC-410W

CVE-2022-21217CRITICAL9.8PL ✓same product

Out-of-bounds write w funkcji TestEmail kamery Reolink RLC-410W

CVE-2019-11001HIGH7.2⚠ KEVsame product

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin ca...

CVE-2021-44354HIGH7.5same product

Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reo...