Paper/Archive/CVE-2021-40410

CVE-2021-40410

talos — An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

EPSS 28%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 98.1.981 × 2019.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [4] the dns_data->dns1 variable, that has the value of the dns1 parameter provided through the SetLocal API, is not validated properly. This would lead to an OS command injection.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

talos (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2021-1424