Is CVE-2021-40407 (Reolink RLC-410W IP Camera OS Command Injection Vulnerability) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-40407 to its Known Exploited Vulnerabilities catalogue on 18 December 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for CVE-2021-40407

CVE-2021-40407 is not just a published flaw, it is now a confirmed active-threat item. For a device like a Reolink RLC-410W, that shifts the question from “is there a bug?” to “can an exposed camera be reached, abused, and potentially used as an entry point or foothold?” In practice, that means exposure assessment must be immediate, not scheduled into a normal maintenance cycle.

For teams triaging actively exploited issues, the right first check is simple: do you actually have this camera model anywhere in scope, and is it reachable from untrusted networks or remote management paths? That is the point at which a vulnerability becomes an operational security problem, because externally reachable devices are the easiest to abuse once exploit activity exists.

Use the Zero-Day and Exploited Vulnerabilities Guide for the triage pattern that matters here, namely fast exposure confirmation, emergency mitigation, and post-patch hunting when a vulnerability has already entered active exploitation.

Why authenticated command injection on an IP camera is high-risk

An authenticated OS command injection flaw in a network camera is serious because the device is usually trusted, visible on the network, and often deployed with broad reach into operational environments. If an attacker can authenticate and then pass malicious input into the device network settings function, the result can be command execution on a connected edge device that was never intended to run arbitrary commands.

That matters more than a routine application bug. Cameras often sit outside the normal hardened-server fleet, yet they still live on sensitive networks and may have management access, local storage, or visibility into places that matter physically and digitally. A compromised camera can therefore become a pivot point, a persistence point, or simply a reliable way to disrupt monitoring and trust in the environment.

The IoT Security Guide is the best internal companion for understanding why device identity, segmentation, firmware hygiene, and exposed management planes are decisive controls for IP camera risk.

What to do if patching must wait

If you cannot remediate immediately, treat the camera as a high-value exposed asset and reduce its reach first. Restrict management access to trusted administrative paths, remove unnecessary internet exposure, and separate the device from broader production or user networks as far as the environment allows. The practical goal is to narrow the attacker’s path while the fix window remains open.

You should also assume that active exploitation may have preceded detection. Review device logs if available, look for unusual configuration changes, unexpected reboots, outbound connections, or signs that the camera has been used to reach other internal systems. Where device visibility is poor, corroborate with network telemetry and firewall logs rather than trusting the camera alone.

For the vulnerability handling side of that work, the Vulnerability Management Guide provides the prioritisation model for KEV-listed issues, verification, exception handling, and remediation tracking.

Risk and Threat Considerations

Once a flaw is in CISA’s KEV catalogue, the risk is no longer theoretical. The combination of public product exposure, device-level access, and known active exploitation means attackers can target weakly managed cameras for foothold, disruption, or lateral movement opportunities.

Failure mechanism: An attacker who can reach the device and satisfy the authentication condition can inject operating-system commands through the vulnerable network settings path, turning a trusted edge appliance into an execution point.

Impact: The most likely consequences are device compromise, service disruption, loss of trust in surveillance coverage, and possible use of the camera as a stepping stone into adjacent systems or networks.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Camera admin access and exposure control depend on tight account management.
	CIS-12 — Network Infrastructure Management	Segmentation and management-plane restriction are central to reducing camera exposure.
	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation makes fast identification, prioritisation and remediation essential.
Recommendation — Limit and review camera admin access, especially any shared or remote management credentials. Segment the camera and restrict management traffic to trusted admin networks only. Prioritise and remediate the camera vulnerability as an actively exploited issue.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Actively exploited device flaws require continuous exposure discovery and tracking.
	SI-2 — Flaw Remediation	Confirmed exploitation makes prompt remediation the core control response.
Recommendation — Continuously scan and track deployed cameras so exposed vulnerable assets are found quickly. Apply the vendor fix or mitigation promptly and document any accepted exception.

Practitioner Guidance

What to prioritise: Inventory every Reolink RLC-410W instance first, then determine whether any unit is exposed outside a tightly controlled admin path. If the device is internet reachable or broadly reachable inside the network, treat it as urgent even before you complete deeper forensics.

What to verify: Confirm whether configuration pages, remote admin interfaces, VPN paths, or vendor cloud integrations can reach the camera, because the exploit path depends on reachable management functionality. If you cannot prove exposure is constrained, assume it is not constrained.

Decision rule: If you cannot patch immediately, isolate the camera, reduce administrative access to the minimum set of operators and networks, and increase logging around the device and its surrounding segment. If there are signs of abnormal behaviour, escalate to compromise assessment rather than treating it as a simple patch backlog item.

Practitioner takeaway: KEV status changes the decision threshold, act as though exploitation is already a live operational condition, and make exposure reduction and compromise checks part of the same response.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org