CVE-2021-40414

Name of the Vulnerable Software and Affected Versions reolink RLC-410W version 3.0.0.136 20121102

Description An incorrect default permission issue exists in the cgiserver.cgi cgi check ability functionality. The SetMdAlarm API sets movement detection parameters, allowing the setting of sensitivity and ignored camera spaces for movement detection. Due to the lack of a specific case for the SetMdAlarm API in cgi check ability, user permission defaults to 7, giving non-administrative users the ability to change movement detection parameters.

Recommendations For reolink RLC-410W version 3.0.0.136 20121102, consider restricting access to the SetMdAlarm API to prevent non-administrative users from changing movement detection parameters until a patch is available. As a temporary workaround, disabling the cgi check ability functionality could minimize the risk of exploitation.