CVE-2021-44367
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots via specially crafted HTTP requests targeting the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks causing continuous device reboots, rendering surveillance cameras unavailable for extended periods.
Likely Case
Temporary service disruption with cameras rebooting when targeted, causing gaps in surveillance footage.
If Mitigated
Minimal impact if devices are behind firewalls with restricted HTTP access and network segmentation.
🎯 Exploit Status
Exploitation requires sending a malformed HTTP request to the cgiserver.cgi endpoint; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for updated firmware beyond v3.0.0.136_20121102
Vendor Advisory: https://reolink.com/support/security-advisories/
Restart Required: Yes
Instructions:
1. Log into Reolink camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Download latest firmware from Reolink website. 4. Upload and apply firmware update. 5. Reboot camera after update completes.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock HTTP access to camera management interface from untrusted networks.
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable UPnP
allTurn off UPnP functionality if not required to reduce attack surface.
🧯 If You Can't Patch
- Place cameras behind firewalls with strict inbound rules, allowing only trusted IPs to access HTTP/HTTPS ports.
- Segment camera network from critical infrastructure to limit blast radius if exploited.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device Information; if version is v3.0.0.136_20121102, device is vulnerable.Check Version:
curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep versionVerify Fix Applied:
After firmware update, verify version has changed from v3.0.0.136_20121102 and test with known exploit payloads (if available) to confirm no reboot occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to cgiserver.cgi endpoint
- Camera reboot logs in system events
- Failed JSON parsing errors in web server logs
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON
- Increased traffic to camera management ports from suspicious sources
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" OR event="reboot")