CVE-2021-44395
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots during critical events.
Likely Case
Temporary camera reboots causing 1-2 minutes of surveillance downtime per attack, potentially disrupting continuous monitoring.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires sending malformed JSON in HTTP requests to the cgiserver.cgi endpoint. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21100909 or later
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Upload latest firmware from Reolink website. 4. Wait for automatic reboot and verification.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Access Control Lists
linuxRestrict HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place cameras behind firewall with strict inbound rules allowing only trusted IPs
- Disable remote web interface access and use only local network or Reolink app
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://camera-ip/cgi-bin/system.cgi?cmd=getDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is v3.0.0.148_21100909 or later, then test with proof-of-concept request📡 Detection & Monitoring
Log Indicators:
- Multiple reboot events in system logs
- HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to camera port 80 with GetMask parameter
- Unusual reboot patterns from single source
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi")