CVE-2021-44382 – A denial-of-service vulnerability in Reolink RL... (How to Fix)

Q: What is the severity of CVE-2021-44382?

CVE-2021-44382 has a CVSS score of 7.7 (HIGH). A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users with internet-exposed cameras.

📋 TL;DR

A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users with internet-exposed cameras.

💻 Affected Systems

Products:

Reolink RLC-410W

Versions: v3.0.0.136_20121102

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects specific firmware version; other Reolink models may have similar vulnerabilities.

📦 What is this software?

Rlc 410w Firmware by Reolink

View all CVEs affecting Rlc 410w Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Persistent device reboots causing extended camera downtime, potentially disabling security monitoring systems.

🟠

Likely Case

Temporary camera unavailability requiring manual intervention to restore service.

🟢

If Mitigated

Minimal impact if cameras are behind firewalls with restricted HTTP access.

🌐 Internet-Facing: HIGH - Attackers can exploit remotely without authentication if cameras are exposed to internet.

🏢 Internal Only: MEDIUM - Requires internal network access but still exploitable without credentials.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple HTTP request with malformed JSON payload triggers vulnerability; exploit details published in Talos report.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Later firmware versions (check Reolink support)

Vendor Advisory: https://support.reolink.com/hc/en-us/articles/

Restart Required: Yes

Instructions:

1. Log into camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Upload latest firmware from Reolink website. 4. Wait for automatic reboot.

🔧 Temporary Workarounds

Network Segmentation

linux

Restrict HTTP access to camera management interface

iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

Disable Remote Access

all

Turn off UPnP and port forwarding to prevent internet exposure

🧯 If You Can't Patch

Place cameras behind firewall with strict inbound rules blocking port 80/443 from untrusted networks
Implement network monitoring for repeated reboot patterns or malformed HTTP requests to cgiserver.cgi

🔍 How to Verify

Check if Vulnerable:

Check firmware version in camera web interface: System > Device Information > Firmware Version

Check Version:

curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep Firmware

Verify Fix Applied:

Confirm firmware version is newer than v3.0.0.136_20121102 and test with crafted HTTP request (if safe)

📡 Detection & Monitoring

Log Indicators:

Repeated device reboots
HTTP 500 errors to cgiserver.cgi
SetIrLights parameter errors

Network Indicators:

HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON
Unusual reboot patterns

SIEM Query:

source="camera_logs" AND ("reboot" OR "cgiserver.cgi" AND "500")

📊 Metadata

CVE ID: CVE-2021-44382

CVSS v3 Score: 7.7 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CWE: CWE-20

Published: January 28, 2022

Last Updated: November 21, 2024

🔗 References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421 Exploit,Technical Description,Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421 Exploit,Technical Description,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-44382, you might also want to check these: