CVE-2021-40407
KEVReolink RLC-410W IP Camera OS Command Injection Vulnerability
Description
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HPublishedJan 28, 2022
Last modifiedJun 17, 2026
Added to KEVDec 18, 2024
Remediation dueJan 8, 2025
References
- talosintelligence.com/vulnerability_reports/TALOS-2021-1424ExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40407US Government Resource
0 recent articles mention this CVE
71
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 656 days
- CVSS
- 7.2 HIGH
- EPSS (30-day exploit probability)
- 47.6% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.