CVE-2021-44403
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks causing repeated reboots, rendering the camera unavailable for extended periods and potentially causing physical security gaps.
Likely Case
Temporary camera unavailability during reboot cycles (1-2 minutes), causing surveillance gaps and potential missed security events.
If Mitigated
Minimal impact if cameras are behind firewalls with restricted HTTP access and network segmentation.
🎯 Exploit Status
Exploitation requires sending malformed JSON in HTTP requests to the cgiserver.cgi endpoint; Talos Intelligence provides technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (check Reolink for specific version)
Vendor Advisory: https://reolink.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into Reolink camera web interface. 2. Navigate to System > Maintenance > Firmware Update. 3. Upload latest firmware from Reolink website. 4. Apply update and allow camera to reboot.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
CGI Endpoint Blocking
linuxBlock access to vulnerable cgiserver.cgi endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "cgiserver.cgi" --algo bm -j DROP
🧯 If You Can't Patch
- Place cameras on isolated VLAN with no internet access
- Implement strict firewall rules allowing only trusted IPs to access camera management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://[CAMERA_IP]/cgi-bin/cgiserver.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test with crafted HTTP request to cgiserver.cgi📡 Detection & Monitoring
Log Indicators:
- Repeated camera reboot events
- HTTP requests to cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi containing GetPtzTattern parameter
- Unusual reboot patterns from camera IPs
SIEM Query:
source="camera_logs" AND ("reboot" OR "cgiserver.cgi") AND "GetPtzTattern"