CVE-2021-40406
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Reolink Rlc-410W是中国Reolink公司的一款 Wifi 安全摄像头。 Reolink RLC-410W v3.0.0.136_20121102 版本的cgiserver.cgi 会话创建功能存在资源管理错误漏洞，一个特别制作的HTTP请求可能阻止用户登录。攻击者可通过发送HTTP请求来触发该漏洞。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-40406
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Reolink Rlc-410W 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Reolink Rlc-410W是中国Reolink公司的一款 Wifi 安全摄像头。 Reolink RLC-410W v3.0.0.136_20121102 版本的cgiserver.cgi 会话创建功能存在资源管理错误漏洞，一个特别制作的HTTP请求可能阻止用户登录。攻击者可通过发送HTTP请求来触发该漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2021-40406
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-40406
请登录查看更多情报信息。
Other References for CVE-2021-40406 (1)
-
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1423 x_refsource_MISC
Same Patch Batch · n/a · 2022-01-28 · 154 CVEs total
| CVE-2021-23484 | 9.8 CRITICAL | Arbitrary File Write via Archive Extraction (Zip Slip) |
| CVE-2021-44463 | 8.1 HIGH | Emerson DeltaV Uncontrolled Search Path Element |
| CVE-2022-22992 | 7.8 HIGH | Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices. |
| CVE-2021-23558 | 7.3 HIGH | Prototype Pollution |
| CVE-2021-31567 | 6.8 MEDIUM | WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnera |
| CVE-2022-22791 | 6.6 MEDIUM | SYNEL - eharmony Authenticated Blind & Stored XSS |
| CVE-2021-23863 | 6.1 MEDIUM | Bosch Video Security 跨站脚本漏洞 |
| CVE-2021-26264 | 6.1 MEDIUM | Emerson DeltaV Missing Authentication for Critical Function |
| CVE-2022-21719 | 6.1 MEDIUM | Reflected XSS using reload button in GLPI |
| CVE-2022-21721 | 5.9 MEDIUM | DOS Vulnerability in next.js |
| CVE-2021-23760 | 5.6 MEDIUM | Prototype Pollution |
| CVE-2022-22790 | 5.6 MEDIUM | SYNEL - eharmony Directory Traversal |
| CVE-2022-21720 | 4.9 MEDIUM | SQL injection using custom CSS administration form in GLPI |
| CVE-2022-23979 | 4.8 MEDIUM | WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (X |
| CVE-2022-23599 | 4.3 MEDIUM | Cross-site Scripting and Open Redirect in Products.ATContentTypes |
| CVE-2021-40339 | 3.7 LOW | OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product |
| CVE-2021-40338 | 3.7 LOW | OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product |
| CVE-2021-40340 | 3.7 LOW | OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product |
| CVE-2021-44372 | Reolink Rlc-410W 输入验证错误漏洞 | |
| CVE-2021-46444 | H.H.G. Multistore SQL注入漏洞 |
Showing top 20 of 154 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-90707
Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_t -
CVE-2026-90698
memcached mcmc Tokenizer proto_text.c try_read_command_ascii -
CVE-2026-90687
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use a -
CVE-2026-90686
GPAC MP4Box loader_bt.c gf_bt_report memory corruption -
CVE-2026-90685
GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
Same weakness: CWE-400
-
CVE-2026-90928
File Browser through 2.63.23 Memory Exhaustion via subtitle -
CVE-2026-90927
filebrowser through 2.63.23 Denial of Service via unbounded -
CVE-2026-88932
multer vulnerable to Denial of Service via orphaned disk wri -
CVE-2026-90582
evanchiu serverless-todo API Todo Endpoint index.js saveTodo -
CVE-2026-90554
vLLM before 0.28.0 Denial of Service via audio extraction
V. Comments for CVE-2021-40406
No comments yet