CVE-2021-44371
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots via specially crafted HTTP requests targeting the cgiserver.cgi JSON parser. This affects Reolink RLC-410W camera users running vulnerable firmware versions, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots and potentially enabling physical security breaches during downtime.
Likely Case
Temporary camera reboots causing surveillance gaps of 1-2 minutes per attack, disrupting continuous monitoring and potentially missing critical events.
If Mitigated
Minimal impact with proper network segmentation and monitoring, allowing quick detection and response to attack attempts.
🎯 Exploit Status
The vulnerability is well-documented in public advisories with technical details that could be easily weaponized into automated attack tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink support for latest firmware updates
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/
Restart Required: Yes
Instructions:
1. Log into Reolink client software or web interface. 2. Navigate to Settings > System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Camera will automatically reboot after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with restricted access to management interfaces
Firewall Restrictions
linuxBlock external HTTP access to camera management ports (typically 80, 443)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to prevent unauthorized HTTP requests to camera management interfaces
- Deploy network monitoring to detect and alert on repeated reboot patterns or suspicious HTTP traffic to camera IPs
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface: Settings > System > Device Information > Firmware VersionCheck Version:
curl -s http://[CAMERA_IP]/cgi-bin/api.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is updated beyond v3.0.0.136_20121102 and test with controlled HTTP request to cgiserver.cgi endpoint📡 Detection & Monitoring
Log Indicators:
- Repeated camera reboot events
- HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
- SetEmail parameter in HTTP logs without proper object structure
Network Indicators:
- HTTP POST requests to camera IP on port 80/443 containing SetEmail parameter
- Multiple TCP connections to camera followed by device becoming unresponsive
SIEM Query:
source="camera_logs" AND ("reboot" OR "cgiserver.cgi") | stats count by src_ip dest_ip