CVE-2021-44373
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted HTTP request to the Reolink RLC-410W camera's cgiserver.cgi JSON command parser. When exploited, it triggers a device reboot by manipulating the SetAutoFocus parameter. This affects users of Reolink RLC-410W cameras running vulnerable firmware.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render the camera unavailable for extended periods, disrupting surveillance capabilities and potentially masking other malicious activities.
Likely Case
Attackers cause temporary camera reboots, creating surveillance gaps and requiring manual intervention to restore functionality.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated camera reboots without affecting other systems.
🎯 Exploit Status
Exploitation requires sending a malformed HTTP request to the vulnerable endpoint. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21100905 or later
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/4412336149657
Restart Required: Yes
Instructions:
1. Log into Reolink web interface
2. Navigate to System > Maintenance
3. Check for firmware updates
4. Download and install latest firmware
5. Camera will reboot automatically
🔧 Temporary Workarounds
Network Segmentation
allIsolate camera network from untrusted networks
Access Control Lists
linuxRestrict HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place cameras on isolated VLAN with no internet access
- Implement strict firewall rules allowing only necessary traffic to camera IPs
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://camera_ip/cgi-bin/system.cgi?cmd=getDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is v3.0.0.148_21100905 or later and test with proof-of-concept exploit📡 Detection & Monitoring
Log Indicators:
- Multiple reboot events in camera logs
- HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with SetAutoFocus parameter
- Unusual reboot patterns from camera IPs
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi")