Cross site request forgery (csrf)

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability...

Design/Logic Flaw

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be...

Command injection

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This...

CVE-2021-40407

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This...

CVE-2021-40416

Mode C Affected product: Reolink RLC-410W (v3.0.0.136_20121102). Issue: In the cgiserver.cgi cgi_check_ability function, several API calls (notably Get APIs and several privileged actions) can be executed by authenticated users due to incorrect default permissions. TALOS identifies multiple impro...

CVE-2021-40416

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. All the Get APIs that are not included in cgicheckability are already executable by any logged-in users. An attacker can send an HTTP request to trigger...

CVE-2021-40413

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be...

CVE-2021-40413

CVE-2021-40413 affects Reolink RLC-410W v3.0.0.136_20121102. The vulnerability is in the cgiserver.cgi function cgi_check_ability, where many APIs (including privileged ones such as UpgradePrepare, Format, Get, etc.) do not have specific cases and fall back to a default permission of 7, allowing ...

CVE-2022-21217

An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40406

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40406

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40406

The CVE-2021-40406 entry concerns a denial-of-service flaw in the cgiserver.cgi session creation path of Reolink RLC-410W (v3.0.0.136_20121102). TALOS documents a vulnerability where a specially crafted HTTP request can pollute the in-memory sessions list, potentially filling it and preventing us...

CVE-2021-40404

The CVE-2021-40404 vulnerability affects Reolink RLC-410W (v3.0.0.136_20121102) in the cgiserver.cgi Login path. A specially crafted HTTP request can bypass authentication, enabling an attacker to issue commands without a logged-in session. The TALOS details show that the camera parses a JSON bod...

CVE-2021-40404

An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-21134

CVE-2022-21134 affects the Reolink RLC-410W firmware upgrade path. TALOS details a vulnerability in the firmware’s Upgrade API: the update process lacks cryptographic verification of the firmware image, allowing an attacker to trigger a firmware update via the Upgrade API, potentially delivering ...

CVE-2022-21134

A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-21796

CVE-2022-21796 affects Reolink RLC-410W (v3.0.0.136_20121102) in the netserver parse_command_list function. A specially crafted HTTP request can cause a memory corruption via an out-of-bounds write, enabled by improper input validation and manipulation of the XML data length during command parsin...

CVE-2022-21796

A memory corruption vulnerability exists in the netserver parsecommandlist functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-21796

A memory corruption vulnerability exists in the netserver parsecommandlist functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40423

A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.13620121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...