CVE-2021-44378
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots via specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent device reboots causing extended surveillance downtime, potentially enabling physical security breaches during camera unavailability.
Likely Case
Temporary camera reboots disrupting surveillance feeds for several minutes, causing gaps in monitoring coverage.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Simple HTTP POST request with malformed JSON to cgiserver.cgi endpoint triggers reboot. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later than v3.0.0.136_20121102
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Download latest firmware from Reolink support site. 4. Upload and install firmware update. 5. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Access Control Lists
linuxRestrict HTTP access to camera management interface to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place cameras behind firewall with strict inbound rules blocking all external access to web interface
- Disable remote web interface access and use only local network or Reolink app with updated authentication
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://CAMERA_IP/cgi-bin/api.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test HTTP POST to cgiserver.cgi no longer causes reboot📡 Detection & Monitoring
Log Indicators:
- Multiple reboot events in system logs
- HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST to camera IP port 80 with Content-Type: application/json and malformed SetEnc parameter
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi")