You do not have permission to edit this page, for the following reasons:
The Reolink RLC-410W is a 4MP Wi-Fi bullet network camera. It has an unusually well-documented vulnerability record for a consumer device: twenty CVEs list rlc-410w directly in their CPE configurations, the bulk of them reported by Cisco Talos against firmware v3.0.0.136. The worst are CVE-2021-40408 and CVE-2021-40409, both CVSS 9.8 OS command injection flaws in the device network settings, alongside CVE-2021-40404 (authentication bypass in cgiserver.cgi Login) and CVE-2021-40407 (command injection). Because the flaws are reachable over the network against the camera's own service, exploitation does not require the user to do anything. Reolink released fixed firmware and publishes updates, but installation is manual, so a large share of units still run the vulnerable build. The device is rated D. The arithmetic is worth stating plainly: the Device category is pulled down to 2 because no botnet campaign naming this exact model was found and Reolink does ship updates, even though the vulnerability criteria themselves score at the maximum. Multiple remotely reachable flaws, including an authentication bypass and CVSS 9.8 command injection, are documented for this model, and the existing authentication controls are defeated by those same flaws, so the rating sits at the top of the D band rather than dropping lower. Values for hardware tampering, prior attacks, communications encryption, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level Reolink documentation could be retrieved; the rating rests on the CVE evidence alone.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
