CVE-2021-44384
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unusable for extended periods, compromising physical security monitoring.
Likely Case
Temporary camera reboots causing surveillance gaps of 1-2 minutes per attack.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting attack surface.
🎯 Exploit Status
Exploit requires sending malformed JSON to SetPtzTattern parameter; trivial for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21100909 or later
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/4412444069657
Restart Required: Yes
Instructions:
1. Log into camera web interface. 2. Navigate to Settings > System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access.
Firewall Rules
linuxBlock external access to camera web interface ports (typically 80, 443).
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted management IPs.
- Monitor for HTTP requests containing malformed JSON to SetPtzTattern parameter.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under Settings > System > Device Information.Check Version:
curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep versionVerify Fix Applied:
Confirm firmware version is v3.0.0.148_21100909 or later and test with proof-of-concept exploit.📡 Detection & Monitoring
Log Indicators:
- Camera reboot logs
- HTTP requests with malformed JSON to cgiserver.cgi
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with SetPtzTattern parameter
SIEM Query:
source="camera.log" AND "reboot" OR "cgiserver.cgi" AND "SetPtzTattern"