CVE-2021-40411
published 2022-01-28CVE-2021-40411: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2…
PriorityP351high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
4.70%
90.7th percentile
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS command injection.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| reolink | rlc-410w_firmware | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)
suricata·2025-01-27·CVSS 7.2
CVE-2021-40410 [HIGH] ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/api.cgi|3f|cmd|3d|SetLocalLink"; fast_pattern; startswith; http.request_body; content:"|22|cmd|22|"; content:"|22|SetLocalLink|22 2c|"; within:20; content:"|22|dns"; distance:0; pcre:"/^[12]\x22\x3a[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,talosintelligence.com/vulnerability_reports/TALOS-2021-1424; reference:cve,2021-40410; r
No public exploits indexed.
No writeups or analysis indexed.
2022-01-28
Published