Lucene search

TalosCVELIST:CVE-2021-40408

HistoryJan 28, 2022 - 7:10 p.m.

CVE-2021-40408

2022-01-2819:10:13

CWE-78

talos

www.cve.org

cve-2021-40408

ddns settings

setddns api

os command injection

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.004

Percentile

74.6%

JSON

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.

References

talosintelligence.com/vulnerability_reports/TALOS-2021-1424

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.004

Percentile

74.6%

JSON

Related for CVELIST:CVE-2021-40408