CVE-2021-44386
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted HTTP request to the Reolink RLC-410W camera's cgiserver.cgi JSON command parser. The attack triggers a device reboot when the SetPtzPatrol parameter is not properly validated as an object. This affects users of Reolink RLC-410W cameras with vulnerable firmware.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render the camera unavailable for extended periods, disrupting surveillance capabilities.
Likely Case
Attackers cause temporary camera reboots, creating surveillance gaps and potential system instability.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated camera reboots.
🎯 Exploit Status
The Talos Intelligence report includes technical details that could be used to create exploit code. The vulnerability requires sending a malformed HTTP request to the cgiserver.cgi endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for updated firmware
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
Restart Required: Yes
Instructions:
1. Check Reolink support for firmware updates. 2. Download the latest firmware for RLC-410W. 3. Upload firmware via camera web interface. 4. Reboot camera after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLANs with strict firewall rules to limit access to cgiserver.cgi endpoint.
Access Control Lists
allImplement ACLs to restrict HTTP access to camera management interface from trusted IPs only.
🧯 If You Can't Patch
- Place cameras behind a WAF or reverse proxy that filters malformed HTTP requests
- Disable remote access features and only allow local network access to cameras
🔍 How to Verify
Check if Vulnerable:
Check camera firmware version via web interface at Settings > System > Firmware UpdateCheck Version:
curl -s http://[camera-ip]/cgi-bin/cgiserver.cgi?cmd=getSystemInfo | grep versionVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test with controlled malformed HTTP requests📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
- Unexpected camera reboots in system logs
Network Indicators:
- HTTP POST requests to cgiserver.cgi with SetPtzPatrol parameter that's not a valid JSON object
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" AND (message="reboot" OR message="crash"))