CVE-2021-40407criticalunder attackCWE-78

CVE-2021-40407

Published · Updated

Follow this CVE+ Monitor RLC-410W IP Camera

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.1epss 48%
from disclosure to weapon
Published on NVDJan 28
CISA KEV+1055d
Action required by CISAfederal deadline: 2025-01-08

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

In short

A camera's network settings allow attackers to inject system commands through the DDNS domain parameter without proper validation. An attacker can send a specially crafted HTTP request to execute arbitrary commands on the device.

Technical detail

OS command injection exists in the SetDdns API endpoint where the ddns->domain variable is insufficiently sanitized before being used in system operations. An unauthenticated remote attacker can inject shell metacharacters via the domain parameter to achieve arbitrary command execution with device privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · n/a