CVE-2021-40407
Reolink RLC-410W IP Camera OS Command Injection Vulnerability
Description
CVE-2021-40407 is a high-severity OS command injection vulnerability in the Reolink RLC-410W IP camera firmware version 3.0.0.136_20121102. The flaw exists in the device network settings functionality, specifically in the DDNS configuration, where the domain parameter passed through the SetDdns API is not properly validated before being used in operating system commands. An authenticated attacker with administrative privileges can exploit this vulnerability to execute arbitrary OS commands on the camera, achieving complete device compromise. With a CVSS v3.1 base score of 7.2 and an EPSS score of 32.58% at the 96.8th percentile, this vulnerability is actively targeted. CISA has added CVE-2021-40407 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 8, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| reolink | rlc-410w firmware | 3.0.0.136_20121102 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40407(US Government Resource)
Weakness Type
OS Command Injection via DDNS Configuration
CVE-2021-40407 is an OS command injection vulnerability in the Reolink RLC-410W camera's network settings handler. The vulnerability specifically affects the DDNS (Dynamic DNS) configuration interface. When an administrator configures DDNS settings through the SetDdns API, the application takes the domain parameter and incorporates it into operating system commands without proper input validation or sanitization. Depending on the DDNS type selected, the ddns->domain variable is used directly in command construction, allowing an attacker to inject shell metacharacters and arbitrary commands. This class of vulnerability enables direct interaction with the underlying Linux-based operating system running on the camera hardware. Learn more about OS command injection at CWE-78.
Impact Analysis
The impact of CVE-2021-40407 is rated High across confidentiality, integrity, and availability. Confidentiality is severely compromised because command injection on the camera's operating system grants access to stored video footage, configuration files containing network credentials, Wi-Fi passwords, and any other data stored on the device. IP cameras often reside in sensitive locations and may capture footage of private areas, making unauthorized access to recordings a significant privacy concern.
Integrity is fully at risk as the attacker can modify firmware, alter camera configurations, disable recording, redirect video streams, and install persistent backdoors. A compromised camera can be repurposed as a surveillance tool controlled by the attacker or used as a network pivot point to attack other devices on the same network.
Availability faces high impact since command execution enables the attacker to disable the camera, corrupt its firmware, or render it permanently inoperable. The attack requires network access (AV:N) and low complexity (AC:L) but does require high-level (administrative) privileges (PR:H). No user interaction is needed (UI:N). While the privilege requirement limits the attack surface to authenticated administrators, many IoT devices ship with default credentials or use weak passwords, effectively lowering the practical barrier. The EPSS score of 32.58% at the 96.8th percentile confirms high exploitation activity. The ransomware association is listed as unknown, but compromised IoT devices are frequently incorporated into botnets and used as network entry points.
Exploit Maturity
CVE-2021-40407 exhibits high exploit maturity with publicly available exploit code and confirmed active exploitation. The vulnerability was discovered and documented by Cisco Talos, and a detailed technical analysis is available on Talos Intelligence, which includes exploitation methodology and proof-of-concept details.
CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 8, 2025. The EPSS score of 32.58% at the 96.8th percentile places it among the top 3.2% of vulnerabilities most likely to be exploited. The availability of detailed technical documentation from Talos, combined with the straightforward nature of command injection exploitation, means that even relatively unsophisticated attackers can weaponize this flaw. IP cameras are attractive targets for botnet operators, surveillance campaigns, and network intrusion teams, as they often have persistent network connectivity, minimal monitoring, and weak security configurations. While the ransomware connection remains unclassified, compromised cameras on enterprise networks have been used as initial access vectors in broader intrusion campaigns.
Remediation
-
Update Reolink RLC-410W firmware immediately. Check the Reolink support website for firmware versions newer than 3.0.0.136_20121102 that address this command injection vulnerability. Apply the update through the camera's web interface or Reolink client application.
-
Change default administrator credentials. Ensure that the camera's administrative account uses a strong, unique password. Many IP camera exploits succeed because devices retain factory-default credentials. Use a password manager to generate and store complex passwords for all IoT devices.
-
Isolate IP cameras on a dedicated network segment. Deploy the RLC-410W and other IoT devices on a separate VLAN with strict firewall rules limiting communication to only necessary services. This prevents a compromised camera from being used to attack other devices on the corporate or home network.
-
Disable unnecessary remote access. If the camera does not need to be accessible from the internet, disable port forwarding, UPnP, and cloud connectivity features. Restrict management interface access to the local network only, and use a VPN for remote administration when required.
-
Monitor for suspicious activity. Implement network monitoring to detect unusual outbound connections from the camera, unexpected DNS queries, or abnormal traffic patterns that may indicate compromise. Review camera access logs regularly for unauthorized login attempts.
Technical Details
CVE-2021-40407 is an OS command injection vulnerability in the Reolink RLC-410W IP camera firmware. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack with low complexity that requires high-level privileges, with maximum impact across all CIA dimensions.
The vulnerability resides in the device network settings functionality, specifically in how the SetDdns API processes DDNS configuration parameters. When a DDNS configuration request is submitted, the application reads the domain parameter and, depending on the selected DDNS type, assigns it to the ddns->domain variable at two distinct code paths. In both cases, the domain value is subsequently incorporated into operating system commands without any sanitization or validation of shell metacharacters.
An authenticated administrator can inject arbitrary commands by including shell metacharacters such as semicolons, backticks, pipe characters, or command substitution syntax within the domain parameter. The injected commands execute with the privileges of the web server process running on the camera, which on embedded Linux systems like the RLC-410W typically runs as root or with equivalent elevated permissions.
The affected firmware version is 3.0.0.136_20121102 of the Reolink RLC-410W. The underlying issue is a failure to implement input validation on the DDNS domain parameter before using it in command construction. Proper remediation requires either sanitizing all shell metacharacters from the input or, preferably, using parameterized command execution that prevents user input from being interpreted as command syntax.
Frequently Asked Questions
What is CVE-2021-40407?
CVE-2021-40407 is an OS command injection vulnerability in the Reolink RLC-410W IP camera. It allows an authenticated administrator to execute arbitrary operating system commands through the DDNS configuration interface by injecting malicious values in the domain parameter.
Does exploiting this vulnerability require authentication?
Yes. The attacker needs administrative access to the camera's web interface, which is reflected in the CVSS high-privilege requirement (PR:H). However, many IP cameras use default or weak credentials, which significantly lowers the practical barrier to exploitation.
What can an attacker do after exploiting CVE-2021-40407?
With command injection on the camera's operating system, an attacker can access stored video footage, modify camera configurations, install persistent backdoors, use the camera as a pivot point for network attacks, or incorporate it into a botnet.
How was this vulnerability discovered?
The vulnerability was discovered by Cisco Talos during security research on Reolink IP cameras. Talos published a detailed technical advisory including the vulnerability analysis and exploitation methodology under the identifier TALOS-2021-1424.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.