CVE-2022-21199

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1448Broken Link, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1448Broken Link, Third Party Advisory

Timeline

Published: Jan 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21209.8OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write CVE-2022-212018.8A stack-based buffer overflow vulnerability exists in the confers ucloud_add_node_new functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_CVE-2022-212025.5The affected product is vulnerable to an out-of-bounds read, which may result in disclosure of sensitive information.CVE-2022-212037.8Improper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authenti CVE-2022-212047.8Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable esc CVE-2022-212057.5Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may a CVE-2022-212087.5The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks CVE-2022-212097.8The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file CVE-2022-21216.5OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a CVE-2022-212108.8An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP req CVE-2022-212117.5This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is no CVE-2022-212126.5Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of