CVE-2021-44394
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service by sending specially crafted HTTP requests to the cgiserver.cgi JSON command parser in Reolink RLC-410W cameras. Successful exploitation causes the device to reboot, disrupting camera functionality. Users of affected Reolink RLC-410W cameras with vulnerable firmware are impacted.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render cameras unusable for extended periods, disrupting security monitoring and recording capabilities.
Likely Case
Temporary camera reboots causing gaps in surveillance footage and loss of real-time monitoring during reboot cycles.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing unauthorized HTTP requests to the camera interface.
🎯 Exploit Status
Exploitation requires sending malformed JSON via HTTP POST to the vulnerable endpoint. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21021106 or later
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/4412336141079
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Camera will automatically reboot after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with restricted access to prevent unauthorized HTTP requests.
Firewall Rules
allBlock external HTTP access to camera management interface while allowing necessary camera traffic.
🧯 If You Can't Patch
- Implement strict network access controls to limit HTTP access to camera management interface
- Monitor for unusual HTTP requests to cgiserver.cgi endpoint and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device Information. If version is v3.0.0.136_20121102 or earlier, device is vulnerable.Check Version:
curl -s http://[camera-ip]/cgi-bin/system.cgi?cmd=getDevInfo | grep -i firmwareVerify Fix Applied:
Verify firmware version is v3.0.0.148_21021106 or later after update. Test by attempting to send malformed JSON to cgiserver.cgi endpoint (should not cause reboot).📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON
- Unexpected camera reboot events in system logs
Network Indicators:
- HTTP POST requests to cgiserver.cgi with unusual JSON payloads
- Increased HTTP error responses from camera
SIEM Query:
source="camera-logs" AND (uri="/cgi-bin/cgiserver.cgi" AND (status=500 OR method="POST"))