CVE-2021-40413

HIGH

reolink RLC-410W v3.0.0.136_20121102 - Info Disclosure

Title source: llm

Description

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be possible, allegedly, to later on perform the Upgrade. An attacker can send an HTTP request to trigger this vulnerability.

References (1)

Core 1

Core References

Exploit, Technical Description, Third Party Advisory x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425

Scores

CVSS v3 7.1

EPSS 0.0082

EPSS Percentile 52.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-276 CWE-284

Status published

Products (1)

reolink/rlc-410w_firmware 3.0.0.136_20121102

Published Jan 28, 2022

Tracked Since Feb 18, 2026