CVE-2021-44380
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted HTTP request to the Reolink RLC-410W camera's cgiserver.cgi JSON command parser. The SetTime parameter not being properly validated as an object leads to system reboot. This affects Reolink RLC-410W camera users with vulnerable firmware.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render the camera unavailable for extended periods, disrupting surveillance capabilities.
Likely Case
Temporary camera reboot causing loss of surveillance footage during reboot period.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure.
🎯 Exploit Status
The vulnerability requires sending a crafted HTTP request with malformed JSON to the cgiserver.cgi endpoint, which is relatively simple to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21100909 or later
Vendor Advisory: https://reolink.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into Reolink camera web interface. 2. Navigate to System > Maintenance > Firmware Update. 3. Upload the latest firmware file provided by Reolink. 4. Wait for the update to complete and camera to reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Reolink cameras on a separate VLAN with restricted access to management interfaces.
Access Control Lists
linuxImplement firewall rules to restrict HTTP access to camera management interface to trusted IP addresses only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disable remote web interface access and use only local network management
- Implement rate limiting on HTTP requests to the camera to prevent rapid exploitation
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device Information. If version is v3.0.0.136_20121102 or earlier, the device is vulnerable.Check Version:
curl -s http://CAMERA_IP/cgi-bin/cgiserver.cgi?cmd=GetDevInfo | grep -i versionVerify Fix Applied:
After updating, verify firmware version shows v3.0.0.148_21100909 or later in System > Device Information.📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON
- Camera reboot events in system logs
Network Indicators:
- HTTP requests containing malformed SetTime parameter to camera IP
- Unusual traffic patterns to camera management port
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" AND (json_contains("SetTime") OR message="reboot"))