CVE-2021-44366
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service by sending specially crafted HTTP requests to the cgiserver.cgi JSON command parser in Reolink RLC-410W cameras. Successful exploitation forces the device to reboot, disrupting camera functionality. All users of affected Reolink RLC-410W cameras with vulnerable firmware are impacted.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render cameras unusable for extended periods, disrupting security monitoring and potentially creating security blind spots.
Likely Case
Temporary camera downtime requiring manual reboot, interrupting surveillance feeds for minutes until device restarts.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires only HTTP access to the device's web interface. No authentication needed. Proof of concept details available in Talos reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink firmware updates post-2021
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Reboot camera after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Access Control Lists
linuxRestrict HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place cameras behind firewall with strict inbound rules allowing only trusted IPs
- Disable remote web interface access and use only local network management
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://camera-ip/cgi-bin/system.cgi?cmd=getDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test with controlled HTTP requests📡 Detection & Monitoring
Log Indicators:
- Multiple reboot events in system logs
- HTTP requests to cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with unusual payloads
- Sudden loss of camera connectivity followed by reboot
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi")