Lucene search

TalosCVELIST:CVE-2021-40415

HistoryJan 28, 2022 - 7:10 p.m.

CVE-2021-40415

2022-01-2819:10:11

CWE-284

talos

www.cve.org

vulnerability

reolink rlc-410w

cgi_check_ability

default permission

format api

sd card

device reboot

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

31.9%

JSON

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a specific case, the user permission will default to 7. This will give non-administrative users the possibility to format the SD card and reboot the device.

References

talosintelligence.com/vulnerability_reports/TALOS-2021-1425

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

31.9%

JSON

Related for CVELIST:CVE-2021-40415