deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22819
Published: 2022-01-28
Description: A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
CVE: CVE-2021-22820
Published: 2022-01-28
Description: A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
CVE: CVE-2021-22821
Published: 2022-01-28
Description: A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
CVE: CVE-2021-22822
Published: 2022-01-28
Description: A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
CVE: CVE-2021-22825
Published: 2022-01-28
Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with NMC2 (V6.9.6 or earlier), AP7xxx and AP8xxx with NMC3 (V1.1.0.3 or earlier), and APDU9xxx with NMC3 (V1.0.0.28 or earlier)
CVSS Score: 8.0 (HIGH)
CWE: CWE-200, CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-04
CVE: CVE-2021-22826
Published: 2022-01-28
Description: A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22827. Affected Product: EcoStruxure� Power Monitoring Expert 9.0 and prior versions
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-03
CVE: CVE-2021-22827
Published: 2022-01-28
Description: A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22826. Affected Product: EcoStruxure� Power Monitoring Expert 9.0 and prior versions
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-03
CVE: CVE-2021-23174
Published: 2022-01-28
Description: Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-persistent-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-persistent-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-23863
Published: 2022-01-28
Description: HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView, thus allowing the Application to display web resources controlled by the attacker.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://psirt.bosch.com/security-advisories/bosch-sa-844050.html; https://psirt.bosch.com/security-advisories/bosch-sa-844050-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-844050.html
CVE: CVE-2021-26264
Published: 2022-01-28
Description: A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04
CVE: CVE-2021-27654
Published: 2022-01-28
Description: Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-640, CWE-640
References: https://collaborate.pega.com/discussion/pega-security-advisory-c21; https://collaborate.pega.com/discussion/pega-security-advisory-c21
CVE: CVE-2021-31567
Published: 2022-01-28
Description: Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://github.com/WPChill/download-monitor/blob/master/changelog.txt; https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-arbitrary-file-download-vulnerability; https://wordpress.org/plugins/download-monitor/#developers
CVE: CVE-2021-40338
Published: 2022-01-28
Description: Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
CVSS Score: 3.7 (LOW)
CWE: CWE-209
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-40339
Published: 2022-01-28
Description: Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
CVSS Score: 3.7 (LOW)
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-40340
Published: 2022-01-28
Description: Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-40388
Published: 2022-01-28
Description: A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1399; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1399
CVE: CVE-2021-40389
Published: 2022-01-28
Description: A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1400; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1400
CVE: CVE-2021-40396
Published: 2022-01-28
Description: A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1408; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1408
CVE: CVE-2021-40397
Published: 2022-01-28
Description: A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1409; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1409
CVE: CVE-2021-40404
Published: 2022-01-28
Description: An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1420; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1420
CVE: CVE-2021-40406
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1423; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1423
CVE: CVE-2021-40407
Published: 2022-01-28
Description: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40407
CVE: CVE-2021-40408
Published: 2022-01-28
Description: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
CVE: CVE-2021-40409
Published: 2022-01-28
Description: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->password variable, that has the value of the password parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
CVE: CVE-2021-40410
Published: 2022-01-28
Description: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [4] the dns_data->dns1 variable, that has the value of the dns1 parameter provided through the SetLocal API, is not validated properly. This would lead to an OS command injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
CVE: CVE-2021-40411
Published: 2022-01-28
Description: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS command injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
CVE: CVE-2021-40412
Published: 2022-01-28
Description: An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [8] the devname variable, that has the value of the name parameter provided through the SetDevName API, is not validated properly. This would lead to an OS command injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424
CVE: CVE-2021-40413
Published: 2022-01-28
Description: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be possible, allegedly, to later on perform the Upgrade. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425
CVE: CVE-2021-40414
Published: 2022-01-28
Description: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAlarm API sets the movement detection parameters, giving the ability to set the sensitivity of the camera per a range of hours, and which of the camera spaces to ignore when considering movement detection. Because in cgi_check_ability the SetMdAlarm API does not have a specific case, the user permission will default to 7. This will give non-administrative users the possibility to change the movement detection parameters.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425
CVE: CVE-2021-40415
Published: 2022-01-28
Description: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a specific case, the user permission will default to 7. This will give non-administrative users the possibility to format the SD card and reboot the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425
CVE: CVE-2021-40416
Published: 2022-01-28
Description: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any logged-in users. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1425
CVE: CVE-2021-40419
Published: 2022-01-28
Description: A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmware update. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-489
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1428; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1428
CVE: CVE-2021-40423
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1432; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1432; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1432
CVE: CVE-2021-44463
Published: 2022-01-28
Description: Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.
CVSS Score: 8.1 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04
CVE: CVE-2021-4034
Published: 2022-01-28
Description: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-125, CWE-787
References: http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html; http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html; https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
CVE: CVE-2022-21134
Published: 2022-01-28
Description: A firmware update vulnerability exists in the &quot;update&quot; firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347, CWE-347
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1447; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1447
CVE: CVE-2022-21199
Published: 2022-01-28
Description: An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1448; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1448
CVE: CVE-2022-21217
Published: 2022-01-28
Description: An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-457, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1445; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1445
CVE: CVE-2022-21236
Published: 2022-01-28
Description: An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-219, CWE-552
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1446; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1446
CVE: CVE-2022-21796
Published: 2022-01-28
Description: A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1451; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1451