Multiple vulnerabilities in Reolink RLC-410W

1) Use of Hard-coded Cryptographic Key

EUVDB-ID: #VU60058

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21199

CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to the affected product uses a hard-coded cryptographic TLS key. A remote attacker can perform a man-in-the-middle attack and disclose sensitive information.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1448

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Active Debug Code

EUVDB-ID: #VU60077

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40419

CWE-ID: CWE-489 - Active Debug Code

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the firmware update issue in the "factory" binary of reolink. A remote attacker can send a specially crafted request and cause arbitrary firmware update.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1428

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU60076

Risk: High

CVSSv3.1: 8.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21796

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the netserver parse_command_list functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1451

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource exhaustion

EUVDB-ID: #VU60075

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40406

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the cgiserver.cgi session creation functionality. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1423

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU60074

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21236

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a web server misconfiguration in the reolink. A remote attacker can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1446

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper access control

EUVDB-ID: #VU60073

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40404

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the cgiserver.cgi Login functionality. A remote attacker can bypass implemented security restrictions.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1420

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU60072

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21134

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a signature management issue in the "update" firmware checks functionality. A remote attacker can send a specially crafted request and update the firmware.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1447

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) OS Command Injection

EUVDB-ID: #VU60071

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40412

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "SetDevName - name" in the device network settings functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) OS Command Injection

EUVDB-ID: #VU60070

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40411

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "SetLocalLink - dns2" in the device network settings functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) OS Command Injection

EUVDB-ID: #VU60069

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40410

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "SetLocalLink - dns1" in the device network settings functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) OS Command Injection

EUVDB-ID: #VU60068

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40409

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "SetDdns - password" in the device network settings functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) OS Command Injection

EUVDB-ID: #VU60067

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40408

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "SetDdns - userName" in the device network settings functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) OS Command Injection

EUVDB-ID: #VU60066

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40407

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "SetDdns - domain" in the device network settings functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper access control

EUVDB-ID: #VU60065

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40416

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in "Get APIs" in the cgiserver.cgi cgi_check_ability functionality. A remote authenticated attacker can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1425

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper access control

EUVDB-ID: #VU60064

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40415

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in "Format" in the cgiserver.cgi cgi_check_ability functionality. A remote authenticated attacker can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1425

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper access control

EUVDB-ID: #VU60063

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40414

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in "SetMdAlarm" in the cgiserver.cgi cgi_check_ability functionality. A remote authenticated attacker can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1425

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improper access control

EUVDB-ID: #VU60062

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40413

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in "UpgradePrepare" in the cgiserver.cgi cgi_check_ability functionality. A remote authenticated attacker can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1425

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper access control

EUVDB-ID: #VU60061

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40405

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the cgiserver.cgi Upgrade API functionality. A remote authenticated attacker can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1422

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Out-of-bounds write

EUVDB-ID: #VU60060

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21217

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the device TestEmail functionality. A remote administrator can create a specially crafted HTTP request, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1445

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Integer overflow

EUVDB-ID: #VU60059

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21801

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in the netserver recv_command functionality. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1450

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Input validation error

EUVDB-ID: #VU60161

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44398

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when rtmp=stop param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Input validation error

EUVDB-ID: #VU60160

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44397

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when rtmp=start param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU60159

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44396

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when Preview param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Input validation error

EUVDB-ID: #VU60158

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44395

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when GetMask param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Input validation error

EUVDB-ID: #VU60157

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44394

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when GetOsd param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Input validation error

EUVDB-ID: #VU60156

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44393

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when GetIsp param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Input validation error

EUVDB-ID: #VU60155

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44392

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when GetImage param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Input validation error

EUVDB-ID: #VU60154

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44391

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when GetEnc param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Input validation error

EUVDB-ID: #VU60153

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44390

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when Format param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Input validation error

EUVDB-ID: #VU60152

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44389

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when GetAbility param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Input validation error

EUVDB-ID: #VU60151

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44388

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when Login param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Input validation error

EUVDB-ID: #VU60150

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44387

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetPtzPreset param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Input validation error

EUVDB-ID: #VU60149

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44386

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetPtzPatrol param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Input validation error

EUVDB-ID: #VU60148

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44385

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetPtzSerial param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Input validation error

EUVDB-ID: #VU60147

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44384

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetPtzTattern param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Input validation error

EUVDB-ID: #VU60146

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44383

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetAutoUpgrade param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Input validation error

EUVDB-ID: #VU60145

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44382

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetIrLights param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Input validation error

EUVDB-ID: #VU60144

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44381

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetPowerLed param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Input validation error

EUVDB-ID: #VU60143

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44380

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetTime param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Input validation error

EUVDB-ID: #VU60142

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44379

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetAutoMaint param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Input validation error

EUVDB-ID: #VU60141

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44378

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetEnc param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Input validation error

EUVDB-ID: #VU60140

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44377

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetImage param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Input validation error

EUVDB-ID: #VU60139

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44376

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetIsp param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Input validation error

EUVDB-ID: #VU60137

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44375

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetOsd param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Input validation error

EUVDB-ID: #VU60135

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44374

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetMask param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Input validation error

EUVDB-ID: #VU60134

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44373

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetAutoFocus param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Input validation error

EUVDB-ID: #VU60133

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44372

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetLocalLink param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Input validation error

EUVDB-ID: #VU60132

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44371

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetEmail param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Input validation error

EUVDB-ID: #VU60131

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44370

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetFtp param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Input validation error

EUVDB-ID: #VU60130

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44369

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetNtp param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Input validation error

EUVDB-ID: #VU60129

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44368

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetNetPort param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Input validation error

EUVDB-ID: #VU60128

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44367

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetUpnp param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Input validation error

EUVDB-ID: #VU60127

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44366

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetP2p param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU60126

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44365

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetDevName param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Input validation error

EUVDB-ID: #VU60125

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44364

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetWifi param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Input validation error

EUVDB-ID: #VU60124

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44363

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetPush param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Input validation error

EUVDB-ID: #VU60123

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44362

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetCloudSchedule param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Input validation error

EUVDB-ID: #VU60122

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44361

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when Set3G param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Input validation error

EUVDB-ID: #VU60120

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44359

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetCrop param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Input validation error

EUVDB-ID: #VU60119

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44360

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetNorm param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Input validation error

EUVDB-ID: #VU60118

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44358

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetRec param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Input validation error

EUVDB-ID: #VU60117

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44357

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetAlarm param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Input validation error

EUVDB-ID: #VU60116

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44356

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetAudioAlarm param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Input validation error

EUVDB-ID: #VU60115

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44355

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when SetMdAlarm param is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Input validation error

EUVDB-ID: #VU60111

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44354

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi JSON command parser functionality when JSON command is not object. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Input validation error

EUVDB-ID: #VU60110

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40423

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the cgiserver.cgi API command parser functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

RLC-410W: 3.0.0.136_20121102

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1432

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.