CVE-2021-44369
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots during critical events.
Likely Case
Temporary camera reboots causing brief surveillance gaps, potentially disrupting continuous recording or live monitoring.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing unauthorized HTTP requests.
🎯 Exploit Status
Exploitation requires sending a malformed HTTP request with invalid JSON to the SetNtp parameter; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for updated firmware
Vendor Advisory: https://reolink.com/security/
Restart Required: Yes
Instructions:
1. Log into camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Upload latest firmware from Reolink website. 4. Reboot camera after installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLANs with strict firewall rules blocking external HTTP access.
Access Control Lists
allImplement IP-based restrictions allowing only authorized management systems to access camera web interface.
🧯 If You Can't Patch
- Place cameras behind firewalls with strict inbound rules blocking port 80/443 from untrusted networks.
- Implement network monitoring for unusual HTTP requests to cgiserver.cgi endpoints.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device Information.Check Version:
Not applicable - check via web interface or Reolink mobile app.Verify Fix Applied:
Confirm firmware version is updated beyond v3.0.0.136_20121102 and test HTTP requests to cgiserver.cgi no longer cause reboots.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /cgi-bin/cgiserver.cgi
- Camera reboot logs without user action
- Failed JSON parsing errors in system logs
Network Indicators:
- HTTP requests with malformed JSON to SetNtp parameter
- Unusual traffic patterns to camera web interface ports
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" OR message="reboot" OR message="JSON parse error")