CVE-2021-40407

high · 7.2Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Added 2024-12-18Remediation due 2025-01-08

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

7.2

CVSS

47.6%

EPSS (exploit prob.)

99th

EPSS percentile

2022-01-28

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
reolink	rlc-410w_firmware	3.0.0.136_20121102
reolink	rlc-410w	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-40407