An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 6 the dns_data->dns2 variable that has the value of the dns2 parameter provided through the SetLocalLink API is not validated properly. This would lead to an OS command injection.