cbcvebase.
CVE-2021-40409
published 2022-01-28

CVE-2021-40409: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS…

PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.66%
88.2th percentile
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->password variable, that has the value of the password parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.

Affected

1 ranges
VendorProductVersion rangeFixed in
reolinkrlc-410w_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/api.cgi?cmd=SetDdns↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDdns Authenticated Command Injection Attempt (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/api.cgi|3f|cmd|3d|SetDdns"; fast_pattern; startswith; http.request_body; content:"|22|cmd|22|"; content:"|22|SetDdns|22 2c|"; within:20; pcre:"/^.+\x22(?:domain|password|username)\x22\x3a[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/Rm"; reference:url,talosintelligence.com/vulnerability_reports/TALOS-2021-1424; reference:cve,2021-40407; reference:cve,2021-40408; reference:cve,2021-40409; classtype:attempted-admin; sid:2059709; rev:1;)
  • →Exploit targets HTTP POST requests to /cgi-bin/api.cgi?cmd=SetDdns; inspect request body for the SetDdns command with shell metacharacters (;, newline, backtick, pipe, $) in the domain, password, or username JSON fields.
  • →The injection vector is the `password` parameter of the SetDdns API, which is passed unsanitized to an OS command based on the DDNS type selected.
  • →Shell metacharacters to detect in the injected field values include URL-encoded and raw forms: semicolon (;/%3B), newline (%0A/0x0a), backtick (`/%60), pipe (|/%7C), and dollar sign ($/%24).
  • →Traffic is expected in plaintext (not TLS); deploy detection at the network perimeter and internally.
  • ·The Snort/Suricata rule (sid:2059709) covers three CVEs simultaneously (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409) across the domain, username, and password parameters; tune alerting context accordingly to attribute the specific parameter exploited.
  • ·The vulnerability is authenticated; detections will only fire on sessions where the attacker has already obtained valid credentials for the device.
  • ·Affected firmware is specifically Reolink RLC-410W v3.0.0.136_20121102; scope detection to that product/version to reduce false positives.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.