# CVE-2021-40407

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

- Page: https://www.vulneraibility.com/cve/CVE-2021-40407
- CVSS: 7.2
- Known exploited: yes, in CISA KEV since 2024-12-18; CISA due date 2025-01-08
- EPSS: 47.63%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-12-21)
- Weakness: CWE-78
- Published: 2022-01-28

## Affected

- reolink:rlc-410w_firmware

## References

- [other] https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40407

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.