Lucene search

TalosCVELIST:CVE-2021-40409

HistoryJan 28, 2022 - 7:10 p.m.

CVE-2021-40409

2022-01-2819:10:14

CWE-78

talos

www.cve.org

cve-2021-40409

os command injection

reolink rlc-410w

network settings

ddns

setddns api

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.004

Percentile

74.6%

JSON

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->password variable, that has the value of the password parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.

References

talosintelligence.com/vulnerability_reports/TALOS-2021-1424

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.004

Percentile

74.6%

JSON

Related for CVELIST:CVE-2021-40409