CVE-2021-40407

The Reolink RLC-410W camera takes the DDNS domain parameter from its SetDdns API and drops it into an OS command without validating it, so an attacker who can call that API injects shell commands that run as root on the camera. The flaw is a classic unsanitized-parameter-to-shell path in network-settings handling; a single crafted HTTP request to the device is the whole exploit, and success means full root control of the camera.

The gating factor is that the SetDdns API requires an authenticated, high-privileged session — the vector reflects that. So this isn't an anonymous internet takeover; it's an attacker who already has admin credentials (default passwords, reused creds, or a prior foothold) turning that access into persistent root code execution and, from there, a foothold on the network the camera sits on. IP cameras are attractive because they're always-on, rarely monitored, and make excellent botnet nodes or pivot points, so the post-auth RCE is worth more than the "needs admin" caveat might suggest.

Our emphasis is credential hygiene and exposure, since the precondition is admin access. We'd flag any RLC-410W on the specified firmware, confirm none are internet-reachable with default or weak credentials, and push them behind segmentation so the management API isn't broadly callable. Where firmware updates lag, network isolation of the camera VLAN is the practical virtual patch — the exploit needs to reach the API, so cutting that reach is the lever.