CVE-2021-44376
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted HTTP request to the cgiserver.cgi JSON command parser in affected Reolink cameras. The malformed SetIsp parameter triggers a reboot, disrupting camera functionality. Users of Reolink RLC-410W cameras with vulnerable firmware are affected.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render cameras unusable for extended periods, disrupting surveillance coverage and potentially masking other malicious activities.
Likely Case
Attackers cause temporary camera reboots, creating surveillance gaps of several minutes during restart cycles.
If Mitigated
With proper network segmentation and access controls, impact is limited to internal network disruption only.
🎯 Exploit Status
Simple HTTP request with malformed JSON parameter; Talos Intelligence published detailed technical analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (check Reolink support for specific fixed version)
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/
Restart Required: Yes
Instructions:
1. Log into Reolink client software or web interface. 2. Navigate to Settings > System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with restricted access to management interfaces.
Firewall Rules
linuxBlock external HTTP access to camera management ports (typically 80, 443, 9000).
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 9000 -j DROP
🧯 If You Can't Patch
- Place cameras behind firewall with strict inbound rules blocking all external HTTP/HTTPS access
- Implement network monitoring for repeated reboot patterns or malformed HTTP requests to cgiserver.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface: Settings > System > Device Information > Firmware VersionCheck Version:
curl -s http://[CAMERA_IP]/cgi-bin/api.cgi?cmd=GetDevInfo | grep -i firmwareVerify Fix Applied:
Confirm firmware version is newer than v3.0.0.136_20121102 and test with controlled malformed HTTP request to cgiserver.cgi endpoint📡 Detection & Monitoring
Log Indicators:
- Repeated camera reboot events
- HTTP 400/500 errors to cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed SetIsp parameter
- Unusual reboot patterns from camera IPs
SIEM Query:
source="camera_logs" AND ("reboot" OR "cgiserver.cgi" AND "400")