CVE-2021-44392
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests with malformed JSON parameters. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots during critical events.
Likely Case
Temporary camera reboots causing 1-2 minutes of surveillance downtime per attack, potentially disrupting continuous monitoring.
If Mitigated
Minimal impact with proper network segmentation and monitoring, allowing quick detection and response to attack attempts.
🎯 Exploit Status
The vulnerability requires no authentication and can be exploited with simple HTTP requests, making it accessible to attackers with basic technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink support for updated firmware
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/
Restart Required: Yes
Instructions:
1. Log into camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Download latest firmware from Reolink website. 4. Upload and install firmware. 5. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allPlace cameras on isolated VLAN with restricted internet access
Firewall Rules
linuxBlock external HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit HTTP traffic to cameras
- Monitor for repeated reboot events and suspicious HTTP requests to cgiserver.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device InformationCheck Version:
curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep versionVerify Fix Applied:
Confirm firmware version is newer than v3.0.0.136_20121102 and test with controlled HTTP request to cgiserver.cgi endpoint📡 Detection & Monitoring
Log Indicators:
- Multiple camera reboot events
- HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to camera IP on port 80/443 with GetImage parameter
- Unusual traffic patterns to camera management interface
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi") | stats count by src_ip