CVE-2021-40408

published 2022-01-28

CVE-2021-40408: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS…

Priority P2 69 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
reolink	rlc-410w_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /cgi-bin/api.cgi?cmd=SetDdns↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDdns Authenticated Command Injection Attempt (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/api.cgi|3f|cmd|3d|SetDdns"; fast_pattern; startswith; http.request_body; content:"|22|cmd|22|"; content:"|22|SetDdns|22 2c|"; within:20; pcre:"/^.+\x22(?:domain|password|username)\x22\x3a[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/Rm"; reference:url,talosintelligence.com/vulnerability_reports/TALOS-2021-1424; reference:cve,2021-40407; reference:cve,2021-40408; reference:cve,2021-40409; classtype:attempted-admin; sid:2059709; rev:1;)

• → Look for HTTP POST requests to /cgi-bin/api.cgi?cmd=SetDdns containing the SetDdns command in the request body, where the 'username', 'domain', or 'password' JSON fields include OS command injection metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24). ↗
• → The vulnerable parameter is 'userName' supplied via the SetDdns API; the value is stored in ddns->username and passed unsanitized to an OS command. Monitor for shell metacharacters in this field. ↗
• → The attack requires authentication (Authenticated Command Injection); correlate with prior successful login sessions to the Reolink device before flagging SetDdns POST requests. ↗
• → The Snort/ET rule (sid:2059709) targets plaintext (non-TLS) traffic on the internal network and perimeter; deploy on both boundaries for coverage. ↗

• · The affected firmware version is specifically v3.0.0.136_20121102 on the Reolink RLC-410W; scope detection rules to this device/firmware combination to reduce false positives. ↗
• · The ET rule (sid:2059709) also covers CVE-2021-40407 and CVE-2021-40409 (domain and password parameters respectively); triage alerts carefully to attribute the correct CVE based on which JSON field contains the injection payload. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.1 CRITICAL CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78