Lucene search

TalosCVELIST:CVE-2021-40416

HistoryJan 28, 2022 - 7:10 p.m.

CVE-2021-40416

2022-01-2819:10:12

CWE-284

talos

www.cve.org

vulnerability

default permission

reolink rlc-410w

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any logged-in users. An attacker can send an HTTP request to trigger this vulnerability.

References

talosintelligence.com/vulnerability_reports/TALOS-2021-1425

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

Related for CVELIST:CVE-2021-40416