Reolink RLC-410W (RLC-410W)

Reolink RLC-410W (RLC-410W)
Security Grade D Calculator v	Reolink RLC-410W (RLC-410W) Brand: Reolink (Parent: Shenzhen Reolink Technology Co., Ltd.) Category: Camera • Model / Gen: RLC-410W Release Date: 2019-01-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—	No published hardware-tampering research specific to this model was found as of 2026-10. The outdoor housing is sealed and the reset button and microSD slot are internal.
Known vulnerabilities	Very common	[https://nvd.nist.gov/vuln/detail/CVE-2021-40408 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1416 🔗 Proof]	Twenty CVEs list rlc-410w directly in their CPE configurations. The most severe are CVE-2021-40408 and CVE-2021-40409 (CVSS 9.8, OS command injection in the device network settings, found by Cisco Talos in firmware v3.0.0.136), plus CVE-2021-40404 (authentication bypass, CVSS 6.5) and CVE-2021-40407 (command injection, CVSS 7.2).
Prior attacks	Rare	—	No campaign naming this exact model was found. Reolink cameras in general are scanned and attacked as part of broad IoT camera sweeps, but no direct evidence ties RLC-410W to a recorded botnet campaign, so the value is kept low and is provisional.
Updatability	Rare	🔗 Proof	Reolink publishes firmware and fixed the Talos-reported flaws, but updates are applied manually through the app or a downloaded file; there is no forced automatic update channel, so units in the field commonly stay on old firmware.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	CVE-2021-40404 is a bypass of the cgiserver.cgi Login function, so authentication towards the device API can be skipped entirely with a crafted HTTP request.
Communications	No encryption	—	RTSP and HTTP on this camera line are unencrypted by default; HTTPS is available but optional. Provisional value, not directly evidenced for this model.
Storage	No encryption	—	Recordings written to the local microSD card are not encrypted at rest. Provisional value, not directly evidenced for this model.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—	The web and app interfaces offer a small fixed role set without granular permissions. Provisional value, not directly evidenced for this model.
Authentication	Basic	🔗 Proof	Username/password login exists, but CVE-2021-40404 lets an unauthenticated attacker bypass the login handler of the device CGI server entirely.
Brute-force protection	Absent	—	No documented account lockout or rate limiting on failed logins. Provisional value, not directly evidenced for this model.
Event logging	Partial logging	—	The device keeps a local log viewable in the app or web interface, with no centralised or tamper-evident logging. Provisional value, not directly evidenced for this model.
Passwords	Require change after setup	—	Reolink requires the user to set a password during initial setup and does not ship a fixed factory default, but no complexity rule is enforced.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Linux (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi, Ethernet (RJ45)
Physical (Dimensions & Mass)	Dimensions: • Mass:

The Reolink RLC-410W is a 4MP Wi-Fi bullet network camera. It has an unusually well-documented vulnerability record for a consumer device: twenty CVEs list rlc-410w directly in their CPE configurations, the bulk of them reported by Cisco Talos against firmware v3.0.0.136. The worst are CVE-2021-40408 and CVE-2021-40409, both CVSS 9.8 OS command injection flaws in the device network settings, alongside CVE-2021-40404 (authentication bypass in cgiserver.cgi Login) and CVE-2021-40407 (command injection). Because the flaws are reachable over the network against the camera's own service, exploitation does not require the user to do anything. Reolink released fixed firmware and publishes updates, but installation is manual, so a large share of units still run the vulnerable build. The device is rated D. The arithmetic is worth stating plainly: the Device category is pulled down to 2 because no botnet campaign naming this exact model was found and Reolink does ship updates, even though the vulnerability criteria themselves score at the maximum. Multiple remotely reachable flaws, including an authentication bypass and CVSS 9.8 command injection, are documented for this model, and the existing authentication controls are defeated by those same flaws, so the rating sits at the top of the D band rather than dropping lower. Values for hardware tampering, prior attacks, communications encryption, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level Reolink documentation could be retrieved; the rating rests on the CVE evidence alone.