CVE-2021-40407 - CVE House
Back to Database
Status published Critical CVE-2021-40407

An OS command injection vulnerability exists in the device network...

Vulnerability Description

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-40407

Credits & Attribution

No credits recorded in the NVD database.

References

More from reolink

View All →
CVE-2022-21801
A denial of service vulnerability exists in the netserver recv_command...
High 8.6
CVE-2022-21796
A memory corruption vulnerability exists in the netserver parse_command_list functionality...
Critical 9.3
CVE-2022-21236
An information disclosure vulnerability exists due to a web server...
High 8.1
CVE-2022-21217
An out-of-bounds write vulnerability exists in the device TestEmail functionality...
Critical 9.1
CVE-2022-21199
An information disclosure vulnerability exists due to the hardcoded TLS...
High 7.5

Affected Vendor

Affected Software

rlc-410w firmware
Vulnerable Versions:
3.0.0.136_20121102

Timeline

Official Publish: January 28th, 2022
Last Modified: October 21st, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration