CVE-2021-40414

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAlarm API sets the movement detection parameters, giving the ability to set the sensitivity of the camera per a range of hours, and which of the camera spaces to ignore when considering movement detection. Because in cgi_check_ability the SetMdAlarm API does not have a specific case, the user permission will default to 7. This will give non-administrative users the possibility to change the movement detection parameters.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-284CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-404156.5An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_201CVE-2021-404168.8An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_201CVE-2021-404179.8When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that weCVE-2021-404189.8When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property CVE-2021-404197.5A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of networCVE-2021-404208.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDFCVE-2021-4042210.0An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A speciallyCVE-2021-404237.5A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A spCVE-2021-404246.5An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted execCVE-2021-404256.5An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted execCVE-2021-404268.8A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commCVE-2021-40435.5NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.
CVE-2021-40414: High severity, CVSS 7.1 | Vulnix