SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-40411

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

HIGH 7.2EPSS 4.70%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS command injection.

CVSS 3.1
7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
4.70% probability · 91th percentile
CISA KEV
Not listed
Weakness
CWE-78
Affected
reolink/rlc-410w firmware
Source
talos-cna@cisco.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.