CVE-2021-40416 Missing authorization in n/a

High 7.1 Published 28 Jan 2022 Updated 15 Apr 2025

Attackers can access unauthorized Get APIs on Reolink cameras due to incorrect default permissions, allowing data retrieval without proper authorization.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-40416?

CVE-2021-40416 is a high-severity missing authorization vulnerability in Reolink Rlc-410w Firmware, published on 28 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any logged-in users. An attacker can send an HTTP request to trigger this vulnerability.

Weakness: CWE-276, CWE-284

Which versions are affected by CVE-2021-40416?

It affects 1 product.

Products include Reolink Rlc-410w Firmware.

How do I fix CVE-2021-40416?

No fix has been published for CVE-2021-40416 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-40416 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-40416 exists.

All Reolink Rlc-410w Firmware vulnerabilities

Sources

Also known as GHSA-c52c-f827-gfpg.