---
id: "CVE-2021-40407"
kind: "vulnerability"
aliases: ["CVE-2021-40407"]
title: "reolink rlc-410w firmware: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W\u2026"
severity: "critical"
cvss: 9.1
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Reolink RLC-410W IP Camera", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "reolink rlc-410w firmware", "fixed": [], "affected": "= 3.0.0.136_20121102", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "iot", "ip-camera", "reolink", "rlc-410w"]
not_affected_if: ["no-rlc-410w-deployed"]
published_at: "2022-01-28T20:15:11+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40407", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# reolink rlc-410w firmware: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W…

Reolink RLC-410W IP cameras have an OS command injection flaw in the network settings feature. An attacker with a valid login can run arbitrary operating system commands on the camera.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Reolink RLC-410W IP Camera affected ? fixed ?
- vendor:reolink rlc-410w firmware affected = 3.0.0.136_20121102 fixed ?

## How to check

Identify any Reolink RLC-410W cameras on the network and note the firmware version; the sources do not give a command for checking.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-40407

## From the sources

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_