CVE-2021-44390
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots via specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots and potentially enabling physical security breaches.
Likely Case
Temporary camera reboots causing surveillance gaps of 1-2 minutes during reboot cycles, disrupting continuous monitoring.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires sending malformed JSON to the cgiserver.cgi endpoint. No authentication needed. Public technical details available in Talos reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21102911 or later
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/4412337313817
Restart Required: Yes
Instructions:
1. Log into camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Upload latest firmware from Reolink website. 4. Camera will reboot automatically after upgrade.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Access Control Lists
linuxRestrict HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Segment cameras on isolated network without internet exposure
- Implement strict firewall rules allowing only trusted IPs to access camera web interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device Information. If version is v3.0.0.136_20121102 or earlier, device is vulnerable.Check Version:
curl -s http://camera_ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep versionVerify Fix Applied:
Confirm firmware version is v3.0.0.148_21102911 or later after upgrade. Test by attempting to send malformed JSON requests to cgiserver.cgi endpoint.📡 Detection & Monitoring
Log Indicators:
- Multiple reboot events in system logs
- HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to camera IP on port 80 with JSON payloads
- Unusual traffic patterns to camera management interface
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi")