CVE-2021-44388
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W camera firmware allows attackers to cause device reboots via specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting camera surveillance functionality.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unusable for extended periods, compromising physical security monitoring.
Likely Case
Temporary camera reboots causing surveillance gaps of 1-2 minutes during restart cycles.
If Mitigated
Minimal impact if cameras are behind firewalls with restricted HTTP access.
🎯 Exploit Status
Exploit requires sending malformed JSON to specific CGI endpoint; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21102909 or later
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/4412336149657
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Upload latest firmware file. 4. Wait for automatic reboot and verification.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external HTTP access to camera web interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -s ! TRUSTED_NETWORK -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! TRUSTED_NETWORK -j DROP
CGI Endpoint Blocking
allBlock access to vulnerable cgiserver.cgi endpoint via web server configuration.
<Location "/cgi-bin/cgiserver.cgi">
Order deny,allow
Deny from all
</Location>
🧯 If You Can't Patch
- Place cameras behind VPN or VLAN with strict access controls
- Implement network monitoring for repeated reboot patterns or malformed HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > System Info > Firmware VersionCheck Version:
curl -s http://CAMERA_IP/cgi-bin/api.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Confirm firmware version is v3.0.0.148_21102909 or later in System Info📡 Detection & Monitoring
Log Indicators:
- Repeated camera reboot events
- HTTP 400/500 errors to /cgi-bin/cgiserver.cgi
- Malformed JSON in web server logs
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with invalid JSON
- Increased reboot-related network traffic patterns
SIEM Query:
source="camera_logs" AND ("reboot" OR "cgiserver.cgi") AND status=500