CVE-2021-40423
📋 TL;DR
A denial of service vulnerability exists in the cgiserver.cgi API command parser of Reolink RLC-410W cameras. Attackers can send specially-crafted HTTP requests to crash the device, rendering it unavailable. This affects users of Reolink RLC-410W cameras running vulnerable firmware.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Camera becomes completely unresponsive, requiring physical reboot or factory reset, disrupting surveillance coverage.
Likely Case
Temporary service disruption where camera stops responding to requests until manually restarted.
If Mitigated
Minimal impact if cameras are behind firewalls with restricted HTTP access and proper network segmentation.
🎯 Exploit Status
Exploitation requires sending malformed HTTP requests to the cgiserver.cgi endpoint. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for latest firmware updates
Vendor Advisory: https://reolink.com/support/
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Reboot camera after update.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
VLAN Segmentation
allIsolate cameras on separate network segment
🧯 If You Can't Patch
- Place cameras behind firewall with strict inbound rules blocking all HTTP/HTTPS from untrusted networks.
- Implement network monitoring for unusual HTTP traffic patterns to camera IPs.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://[CAMERA_IP]/cgi-bin/api.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test HTTP requests to cgiserver.cgi endpoint📡 Detection & Monitoring
Log Indicators:
- Repeated HTTP requests to /cgi-bin/cgiserver.cgi
- Camera service crashes/restarts in system logs
- Unusual request patterns with malformed parameters
Network Indicators:
- HTTP POST/GET requests to cgiserver.cgi with abnormal payloads
- Sudden drop in camera network traffic followed by reboot patterns
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" AND (status=500 OR bytes>10000))