Vulnerability Spotlight: WiFi-connected security camera could be manipulated to spy on communications, among other malicious actions

Summary: Cisco Talos discovered multiple vulnerabilities in the WiFi-connected Reolink RLC-410W security camera, including five denial-of-service flaws, an authentication bypass (TALOS-2021-1420, CVE-2021-40404), and an arbitrary code execution issue (TALOS-2021-1424, CVE-2021-40407 through CVE-2021-40412) rated 9.1 out of 10. Talos worked with Reolink to release an update, and users are advised to update the camera, with version v3.0.0.136_20121102 tested and confirmed affected.
Why it matters: An authentication bypass combined with other flaws lets an attacker delete recordings or reboot the camera with no credentials at all, and the 9.1-severity flaw allows arbitrary code execution on a device whose job is watching your premises.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-40404 CVE-2021-40407 CVE-2021-40412 CVE-2021-40419 CVE-2022-21134 CVE-2022-21199 CVE-2022-21217 CVE-2022-21236 CVE-2022-21796 CVE-2022-21801
Related: CVE-2021-40407: Reolink RLC-410W IP Camera OS Command Injection Vulnerability Known Exploited Vulnerabilities · Dec 18, 2024
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026