CVE-2021-40412
📋 TL;DR
This CVE describes an OS command injection vulnerability in Reolink RLC-410W cameras where an attacker can execute arbitrary commands by manipulating the device name parameter. Attackers with network access to the camera's management interface can potentially gain full system control. This affects Reolink RLC-410W cameras running vulnerable firmware.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, credential theft, lateral movement to other network devices, and use in botnets or ransomware attacks.
Likely Case
Remote code execution leading to camera compromise, surveillance disruption, credential harvesting, and device repurposing for attacks on internal networks.
If Mitigated
Limited to authenticated users only with proper input validation and network segmentation in place.
🎯 Exploit Status
Exploitation requires authentication to the camera's web interface. The vulnerability is in the SetDevName API endpoint at parameter [8].
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for latest firmware updates
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Reboot camera after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Access Control
linuxRestrict management interface access to specific IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disable remote access and only allow local network management
- Implement strict firewall rules blocking all inbound traffic except from management stations
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > System Information > Firmware VersionCheck Version:
curl -s http://camera-ip/cgi-bin/api.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test SetDevName API with malicious input📡 Detection & Monitoring
Log Indicators:
- Unusual device name changes
- Suspicious command execution in system logs
- Multiple failed authentication attempts
Network Indicators:
- Unusual outbound connections from camera
- Traffic to known malicious IPs
- Unexpected port scans originating from camera
SIEM Query:
source="camera-logs" AND ("SetDevName" OR "devname") AND command="*;*" OR command="*|*" OR command="*`*"