CVE-2021-44358
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots via specially crafted HTTP requests targeting the JSON command parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots and potentially enabling physical security breaches.
Likely Case
Temporary camera reboots causing 1-2 minute surveillance gaps, potentially disrupting continuous monitoring or recording.
If Mitigated
Minimal impact if cameras are behind firewalls with restricted HTTP access and network segmentation.
🎯 Exploit Status
Exploitation requires sending a malformed HTTP request with improper SetRec parameter to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for latest firmware updates
Vendor Advisory: https://reolink.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance > Firmware Update. 3. Upload latest firmware from Reolink website. 4. Wait for automatic reboot and verification.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
VLAN Segmentation
allIsolate cameras on separate network segment
🧯 If You Can't Patch
- Implement strict network ACLs to allow camera access only from management stations
- Deploy WAF or reverse proxy with request validation for camera HTTP endpoints
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://camera-ip/cgi-bin/system.cgi?cmd=getDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test with safe vulnerability check tools📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- HTTP requests with malformed JSON to cgiserver.cgi
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with non-object SetRec parameter
- Increased reboot events from single source
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi") | stats count by src_ip