CVE-2021-40413 - CVE House
Back to Database
Status published High CVE-2021-40413

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability...

Vulnerability Description

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be possible, allegedly, to later on perform the Upgrade. An attacker can send an HTTP request to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-40413

Credits & Attribution

No credits recorded in the NVD database.

References

More from reolink

View All →
CVE-2022-21801
A denial of service vulnerability exists in the netserver recv_command...
High 8.6
CVE-2022-21796
A memory corruption vulnerability exists in the netserver parse_command_list functionality...
Critical 9.3
CVE-2022-21236
An information disclosure vulnerability exists due to a web server...
High 8.1
CVE-2022-21217
An out-of-bounds write vulnerability exists in the device TestEmail functionality...
Critical 9.1
CVE-2022-21199
An information disclosure vulnerability exists due to the hardcoded TLS...
High 7.5

Affected Vendor

Affected Software

rlc-410w firmware
Vulnerable Versions:
3.0.0.136_20121102

Timeline

Official Publish: January 28th, 2022
Last Modified: April 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact