---
title: "CVE-2021-40407: Reolink RLC-410W IP Camera OS Command Injection Vulnerability "
url: https://erroneo.us/security/cve/CVE-2021-40407/
description: "CVE-2021-40407 (Reolink RLC-410W IP Camera): Exploited in the wild (CISA KEV). An OS command injection vulnerability exists in the device network settings…"
type: vulnerability-record
section: "Security Digest"
date_published: 2022-01-28
date_modified: 2025-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2021-40407"
kev: true
cvss: 9.1
epss: 0.47635
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2021-40407: Reolink RLC-410W IP Camera OS Command Injection Vulnerability 

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Reolink RLC-410W IP Camera. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2024-12-18, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-01-08 ; treat that as the outer limit, not the target.
- EPSS 47.6% , percentile 99: FIRST’s model estimates a 47.6% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.

## What it is

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

## Affected products (CVE record)

- n/a n/a: see advisory

## Severity

- talos CVSS 3.0: 9.1 `CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2024-12-18; federal due date 2025-01-08. Known ransomware use: Unknown.
- CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 47.63% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [Listed in CISA KEV notes (reolink.com)](https://reolink.com/product-eol/)
- [Listed in CISA KEV notes (reolink.com)](https://reolink.com/download-center/)
- [CVE.org record CVE-2021-40407](https://www.cve.org/CVERecord?id=CVE-2021-40407)
- [NVD entry CVE-2021-40407](https://nvd.nist.gov/vuln/detail/CVE-2021-40407)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40407)
- [talosintelligence.com](https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424)

---
Source page: https://erroneo.us/security/cve/CVE-2021-40407/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt