CVE-2021-40411

7.2 highEPSS 4.7%

High (7.2) in reolink rlc-410w firmware. EPSS 4.7% chance of exploitation in the next 30 days.

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS command injection.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.7% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

reolink:rlc-410w_firmware

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Check your stack JSON