CVE-2021-40414
📋 TL;DR
This vulnerability allows non-administrative users to modify movement detection parameters on Reolink RLC-410W cameras due to incorrect default permissions in the SetMdAlarm API. Attackers can adjust motion sensitivity settings and camera space exclusions, potentially disrupting surveillance coverage. This affects Reolink RLC-410W cameras running vulnerable firmware versions.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers disable or significantly reduce motion detection effectiveness, allowing unauthorized activities to go undetected while surveillance appears functional.
Likely Case
Unauthorized users modify motion detection settings, causing false positives/negatives that degrade surveillance reliability.
If Mitigated
With proper access controls, only authorized administrators can modify motion detection parameters, maintaining surveillance integrity.
🎯 Exploit Status
Exploitation requires authenticated access but with non-admin privileges; simple API call manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for latest firmware updates
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/
Restart Required: Yes
Instructions:
1. Log into Reolink camera web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Reboot camera after installation.
🔧 Temporary Workarounds
Restrict Network Access
linuxLimit camera management interface access to trusted networks only
iptables -A INPUT -s TRUSTED_NETWORK -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Unnecessary User Accounts
allRemove or disable non-essential user accounts to reduce attack surface
🧯 If You Can't Patch
- Implement network segmentation to isolate cameras from untrusted networks
- Enable logging and monitoring for unauthorized configuration changes
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://CAMERA_IP/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test that non-admin users cannot modify motion detection settings📡 Detection & Monitoring
Log Indicators:
- Unauthorized API calls to SetMdAlarm
- Configuration changes from non-admin users
Network Indicators:
- POST requests to /cgi-bin/cgiserver.cgi with SetMdAlarm parameters from unauthorized IPs
SIEM Query:
source="camera_logs" AND (api_call="SetMdAlarm" AND user_role!="admin")