{"id":"CVE-2021-40407","kind":"vulnerability","aliases":["CVE-2021-40407"],"related":[],"title":"reolink rlc-410w firmware: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W…","description":"An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.","summary":"Reolink RLC-410W IP cameras have an OS command injection flaw in the network settings feature. An attacker with a valid login can run arbitrary operating system commands on the camera.","severity":"critical","cvss":9.1,"epss":null,"exploited":true,"exploited_at":"2024-12-18T00:00:00+00:00","products":[{"name":"Reolink RLC-410W IP Camera","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"reolink rlc-410w firmware","fixed":[],"affected":"= 3.0.0.136_20121102","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","iot","ip-camera","reolink","rlc-410w"],"not_affected_if":["no-rlc-410w-deployed"],"how_to_check":"Identify any Reolink RLC-410W cameras on the network and note the firmware version; the sources do not give a command for checking.","fix":null,"status":"open","published_at":"2022-01-28T20:15:11+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:00+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:56:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown; CISA says the product may be end-of-life or end-of-service, so discontinue use if no mitigation is available.","reach":"network","impact":"high","summary":"Reolink RLC-410W IP cameras have an OS command injection flaw in the network settings feature. An attacker with a valid login can run arbitrary operating system commands on the camera.","category":"infrastructure","who_cares":["reolink","rlc-410w","ip-camera","iot"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands on the camera as an authenticated user.","analyst_note":"Find the vendor advisory or firmware fix for CVE-2021-40407 and confirm whether any patched firmware exists for RLC-410W, since the sources list affected and fixed versions as unknown.","how_to_check":"Identify any Reolink RLC-410W cameras on the network and note the firmware version; the sources do not give a command for checking.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-rlc-410w-deployed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00049,"input_tokens":2841,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':24A,27A '-40407':25A,28A '1':101C '2':103C '410w':4A,22A,32A,38A,49B,53B,98C 'api':124C 'arbitrari':75B 'attack':68B,138C 'base':104C 'camera':34A,45B,55B,81B 'command':8A,59B,78B,84C,135C 'cve':23A,26A 'ddns':106C,109C 'devic':14A,90C 'domain':110C,118C 'exist':11A,87C 'exploit':40B 'featur':66B 'firmwar':5A 'firmware':39A 'flaw':61B 'function':17A,93C 'http':142C 'infrastructur':41B 'inject':9A,60B,85C,136C 'iot':42B 'ip':33A,44B,54B 'ip-camera':43B 'lead':131C 'login':72B 'network':15A,64B,91C 'oper':76B 'os':7A,58B,83C,134C 'paramet':119C 'proper':128C 'provid':120C 'reolink':1A,19A,29A,35A,46B,50B,95C 'request':143C 'rlc':3A,21A,31A,37A,48B,52B,97C 'rlc-410w':2A,20A,30A,36A,47B,51B,96C 'run':74B 'send':140C 'set':16A,65B,92C 'setddn':123C 'system':77B 'trigger':145C 'type':107C 'v3.0.0.136_20121102':99C 'valid':71B,127C 'valu':115C 'variabl':111C 'vulner':10A,86C,147C 'would':130C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-01-28T20:15:11+00:00","kev":{"dateAdded":"2024-12-18","dueDate":"2025-01-08","requiredAction":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-40407","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407","severity":null,"published_at":"2024-12-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-40407","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40407","severity":null,"published_at":"2022-01-28T20:15:11+00:00","modified_at":"2026-06-17T04:06:52+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}