CVE-2021-44356
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending specially crafted HTTP requests to the cgiserver.cgi JSON command parser in Reolink RLC-410W cameras. Successful exploitation causes the device to reboot, disrupting camera functionality. Users of affected Reolink RLC-410W cameras with vulnerable firmware versions are impacted.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render the camera unusable for extended periods, potentially disabling security monitoring capabilities.
Likely Case
Temporary camera reboot causing loss of video feed for several minutes until device restarts.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
The vulnerability requires sending crafted HTTP requests to the cgiserver.cgi endpoint, which is relatively straightforward to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for latest firmware updates
Vendor Advisory: https://reolink.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into Reolink camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Download latest firmware from Reolink support site. 4. Upload and apply firmware update. 5. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to camera web interface to trusted networks only
Firewall Rules
linuxBlock external HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate camera network segment from internet and untrusted networks
- Implement strict firewall rules to allow camera access only from management stations
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device InformationCheck Version:
curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep versionVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test HTTP requests to cgiserver.cgi no longer cause reboots📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP POST requests to /cgi-bin/cgiserver.cgi
- Unexpected camera reboot events in system logs
Network Indicators:
- HTTP requests with malformed JSON payloads to camera port 80/443
- Increased HTTP traffic to camera cgi endpoints
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" OR event="reboot")