CVE-2021-40414

Vulnerability

The Reolink RLC-410W camera firmware version v3.0.0.136_20121102 contains an incorrect default permission vulnerability in the cgi_check_ability function of cgiserver.cgi. The SetMdAlarm API, which sets movement detection parameters (sensitivity, schedule, and ignored zones), is not explicitly handled in the permission check switch statement. As a result, the permission defaults to 7 (all bits set), granting any authenticated user the ability to call this API. This affects the SetMdAlarm API only; other APIs have proper permission checks. [1]

Exploitation

An attacker needs only a valid non-administrative user session on the camera. No special network position is required beyond network access to the camera's web interface. The attacker sends a crafted HTTP request to the SetMdAlarm API with desired parameters. Because the permission check defaults to 7, the request is accepted and processed. [1]

Impact

Successful exploitation allows an unprivileged user to modify the motion detection sensitivity, schedule, and ignore zones. This could be used to disable or reduce motion detection, potentially allowing unauthorized physical access to go undetected. The impact is limited to integrity of motion detection settings; no disclosure or code execution is reported. The CVSS score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), indicating high availability impact if motion detection is disabled. [1]

Mitigation

As of the advisory publication (January 28, 2022), no firmware update was available. Users should restrict network access to the camera to trusted users only, and monitor for firmware updates from Reolink. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. [1]