CVE-2021-40407: Reolink RLC-410W Command Injection Flaw

CVE-2021-40407 Overview

An OS command injection vulnerability exists in the device network settings functionality of Reolink RLC-410W IP camera firmware version 3.0.0.136_20121102. The vulnerability is found in the DDNS (Dynamic DNS) configuration handling, where the ddns->domain variable, populated from the domain parameter provided through the SetDdns API, is not properly validated. This improper input validation allows an attacker to inject arbitrary operating system commands that will be executed on the underlying device.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers with network access and administrative credentials can achieve complete device compromise through OS command injection.

Affected Products

• Reolink RLC-410W Firmware version 3.0.0.136_20121102
• Reolink RLC-410W Hardware Device

Discovery Timeline

• 2022-01-28 - CVE-2021-40407 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-40407

Vulnerability Analysis

This command injection vulnerability resides in the network settings functionality of the Reolink RLC-410W IP camera, specifically within the DDNS configuration feature. When processing DDNS settings, the device accepts a domain parameter through the SetDdns API endpoint. Based on the DDNS type selected (handled at two different code paths), the user-supplied domain value is stored in the ddns->domain variable without adequate sanitization or validation.

The fundamental issue is that the domain parameter value is subsequently used in a context where it can influence operating system command execution. Since no input validation is performed to strip or escape shell metacharacters, an attacker can craft a malicious domain value containing command injection payloads that will be interpreted and executed by the underlying operating system shell.

Root Cause

The root cause of this vulnerability is improper input validation (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The SetDdns API fails to sanitize the domain parameter before using it in a system command context. The application does not implement proper input validation to reject or escape shell metacharacters such as semicolons, backticks, pipe characters, or command substitution syntax. This allows user-controlled input to break out of the intended data context and execute arbitrary commands with the privileges of the camera's firmware process.

Attack Vector

The attack is network-based, requiring the attacker to send a specially crafted HTTP request to the vulnerable SetDdns API endpoint. The attacker must have high-privileged (administrative) access to the device's web interface to exploit this vulnerability. Once authenticated, the attacker can submit a malicious DDNS configuration request where the domain field contains OS command injection payloads.

The attack proceeds as follows: an authenticated attacker sends an HTTP request to the SetDdns API with a crafted domain parameter containing command injection syntax (e.g., shell metacharacters followed by arbitrary commands). When the device processes this request based on the DDNS type configuration, the unsanitized domain value is passed to a system command, resulting in execution of the injected commands with device-level privileges.

For detailed technical information about the exploitation mechanism, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2021-40407

Indicators of Compromise

• Unusual HTTP requests to the SetDdns API endpoint containing shell metacharacters (;, |, $(), backticks) in the domain parameter
• Unexpected outbound network connections from the Reolink camera to unknown external hosts
• Anomalous process execution on the camera device that deviates from normal firmware behavior
• Evidence of command injection patterns in device logs or network traffic captures

Detection Strategies

• Monitor network traffic for HTTP requests to Reolink camera management interfaces containing suspicious payloads in DDNS-related parameters
• Implement intrusion detection signatures to identify command injection patterns targeting IoT device APIs
• Deploy network segmentation to isolate IP cameras and enable granular monitoring of their traffic
• Review authentication logs for the camera's web interface to identify unauthorized administrative access attempts

Monitoring Recommendations

• Enable logging on network firewalls and proxies monitoring traffic to and from IP camera segments
• Implement behavioral analysis to detect anomalous command execution patterns on IoT devices
• Configure SIEM alerts for known command injection attack patterns targeting embedded device management interfaces
• Regularly audit network traffic from IP cameras for unexpected external communications

How to Mitigate CVE-2021-40407

Immediate Actions Required

• Verify the firmware version of all Reolink RLC-410W devices in your environment and identify vulnerable installations running version 3.0.0.136_20121102
• Isolate vulnerable cameras on a segmented network with restricted access until patches can be applied
• Implement strict network access controls to limit who can reach the camera's management interface
• Change default credentials and enforce strong administrative passwords on all IP cameras

Patch Information

Organizations should check with Reolink for updated firmware versions that address this command injection vulnerability. Monitor the CISA Known Exploited Vulnerability Catalog for remediation deadlines and the Talos Intelligence Vulnerability Report for additional technical guidance. Given this vulnerability is actively exploited, firmware updates should be prioritized.

Workarounds

• Place the camera behind a firewall and restrict management interface access to trusted administrative networks only
• Disable the DDNS functionality if it is not required for your deployment
• Implement a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious payloads before they reach the device
• Monitor and alert on any configuration changes to the DDNS settings on affected devices

# Network isolation example using iptables on a gateway/firewall
# Restrict access to camera management interface (default port 80/443)
iptables -A FORWARD -d <camera_ip> -p tcp --dport 80 -s <trusted_admin_network> -j ACCEPT
iptables -A FORWARD -d <camera_ip> -p tcp --dport 443 -s <trusted_admin_network> -j ACCEPT
iptables -A FORWARD -d <camera_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <camera_ip> -p tcp --dport 443 -j DROP