Read the docs
TI-2021-17471 Aliases CVE-2021-40407GHSA-3w42-xvwv-qc2q

An OS command injection vulnerability exists in the device network settings functionality…

Priority CRITICAL 91Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

Why it matters now

Exploitation Active In CISA KEV since 2024-12-18CISA due date 2025-01-08
EPSS 0.47635 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:reolink:rlc-410w_firmware:3.0.0.136_20121102:*:*:*:*:*:*:*3.0.0.136_20121102VulnerableReolink
cpe:2.3:h:reolink:rlc-410w:-:*:*:*:*:*:*:*not specified by NVDRunning onReolink
  • cpe:2.3:o:reolink:rlc-410w_firmware:3.0.0.136_20121102:*:*:*:*:*:*:* Versions 3.0.0.136_20121102 Vulnerable ·Reolink
  • cpe:2.3:h:reolink:rlc-410w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Reolink

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2024-12-18 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-40407
  3. 2026-10-03 Alias added: GHSA-3w42-xvwv-qc2q

References

Exploit 1

  • TI-2019-08219 On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an… KEVCVSS 3.1HIGH 7.2
  • TI-2021-17473 An OS command injection vulnerability exists in the device network settings functionality… CVSS 3.1CRITICAL 9.8
  • TI-2021-17472 An OS command injection vulnerability exists in the device network settings functionality… CVSS 3.1CRITICAL 9.8
  • TI-2021-17483 A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W… CVSS 3.1HIGH 7.5
  • TI-2021-20034 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser… CVSS 3.1HIGH 7.7
  • TI-2021-20033 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser… CVSS 3.1HIGH 7.7
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences