CVE-2021-40407

CVE-2021-40407 is an authenticated OS command injection flaw (CWE-78) in the network settings functionality of Reolink RLC-410W IP cameras. An attacker with valid credentials can submit crafted input through the network settings interface, causing injected operating-system commands to execute on the camera's firmware. Successful exploitation yields arbitrary command execution on the device, allowing the attacker to control the camera, alter configuration or video streams, and potentially pivot into the network the camera sits on. Only the Reolink RLC-410W is named as affected, and CISA warns the product may be end-of-life or end-of-service, so a current mitigation or fix may not be available for all deployments. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-18, confirming exploitation in the wild; it sits in the 99th EPSS percentile with a 47.6% probability of exploitation within 30 days, though ransomware use is unconfirmed and no public proof-of-concept is known.

What to do: Check whether your RLC-410W is still supported and, if so, update to the latest Reolink firmware; CISA cautions the model may be end-of-life/end-of-service, in which case no fix may be available. Because exploitation requires valid credentials but is confirmed in the wild, restrict administrative access, disable WAN exposure such as port forwarding and UPnP, and place cameras on an isolated network segment. If no current mitigation or firmware is available, replace or discontinue the device.