CVE-2021-40412

7.2 highEPSS 27%

High (7.2) in reolink rlc-410w firmware. EPSS 27% chance of exploitation in the next 30 days.

An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [8] the devname variable, that has the value of the name parameter provided through the SetDevName API, is not validated properly. This would lead to an OS command injection.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 27% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

reolink:rlc-410w_firmware

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Check your stack JSON