Authentication flaw

An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...

Design/Logic Flaw

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be...

Default configuration

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. The SetMdAlarm API sets the movement detection parameters, giving the ability to set the sensitivity of the camera per a range of hours, and which of the...

CVE-2021-40415

CVE-2021-40415 concerns the Reolink RLC-410W (v3.0.0.136_20121102). The issue resides in the cgiserver.cgi function cgi_check_ability: several APIs (including most sensitive ones) have no explicit case, causing a default permission value of 7 to be applied. This allows a non-administrative (authe...

CVE-2021-40413

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be...

CVE-2021-40413

CVE-2021-40413 affects Reolink RLC-410W v3.0.0.136_20121102. The vulnerability is in the cgiserver.cgi function cgi_check_ability, where many APIs (including privileged ones such as UpgradePrepare, Format, Get, etc.) do not have specific cases and fall back to a default permission of 7, allowing ...

CVE-2021-40414

The CVE-2021-40414 issue affects Reolink RLC-410W (v3.0.0.136_20121102) where the cgiserver.cgi cgi_check_ability function lacks specific cases for certain API commands. As a result, a non-administrative user permission value of 7 can grant access to a broad set of APIs (e.g., SetMdAlarm, Upgrade...

CVE-2021-40406

The CVE-2021-40406 entry concerns a denial-of-service flaw in the cgiserver.cgi session creation path of Reolink RLC-410W (v3.0.0.136_20121102). TALOS documents a vulnerability where a specially crafted HTTP request can pollute the in-memory sessions list, potentially filling it and preventing us...

CVE-2021-40404

The CVE-2021-40404 vulnerability affects Reolink RLC-410W (v3.0.0.136_20121102) in the cgiserver.cgi Login path. A specially crafted HTTP request can bypass authentication, enabling an attacker to issue commands without a logged-in session. The TALOS details show that the camera parses a JSON bod...

Reolink RLC-410W cgi_check_ability access control error vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.Reolink RLC-410W version v3.0.0.13620121102 is vulnerable to an access control error that originates from the cgiserver.cgi cgicheckability that does not properly restrict access from resource access from unauthorized roles. An attacke...

Reolink RLC-410W Denial of Service Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China. reolink RLC-410W v3.0.0.13620121102 = version exists a denial of service vulnerability, which stems from a flaw in the application's cgiserver.cgi session creation function. An attacker could trigger the vulnerability by sending an HT...

PT-2022-12115 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The GetMdState...

PT-2022-12059 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The...

Reolink RLC-410W Certification Bypass Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.An authentication bypass vulnerability exists in Reolink RLC-410W version v3.0.0.136 20121102, which stems from an authentication bypass in the cgiserver.cgi login function. An attacker can exploit this vulnerability to bypass...

Reolink RLC-410W cgiserver.cgi denial of service vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W in version v3.0.0.13620121102, which stems from the JSON parsing function of cgiserver.cgi not doing the correct handling of incoming error messages. An attacker could use th...

PT-2022-12057 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The SetNorm para...

PT-2022-12085 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The login...

PT-2022-12105 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The TestFtp para...

Reolink RLC-410W cgiserver.cgi Upgrade API Denial of Service Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China. A denial of service vulnerability exists in the Reolink RLC-410W v3.0.0.136 20121102 version, which stems from the cgiserver.cgi Upgrade API doing the right thing with incoming error messages, which can be triggered by an attacker by...

PT-2022-12087 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The format param...