CVE-2021-44405
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent device reboots causing extended surveillance downtime, potentially during critical security events.
Likely Case
Temporary service disruption with automatic recovery after reboot, but repeated attacks could create sustained outages.
If Mitigated
Minimal impact if devices are behind firewalls with restricted HTTP access and proper network segmentation.
🎯 Exploit Status
The vulnerability requires sending a malformed HTTP request with a non-object StartZoomFocus parameter, which is trivial to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for updated firmware
Vendor Advisory: https://reolink.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance > Firmware Update. 3. Upload latest firmware from Reolink website. 4. Apply update and reboot device.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock HTTP access to camera management interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s ! TRUSTED_NETWORK -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! TRUSTED_NETWORK -j DROP
Disable Remote Management
allTurn off HTTP/HTTPS management interface if not required
🧯 If You Can't Patch
- Isolate cameras on separate VLAN with strict firewall rules
- Implement network monitoring for HTTP requests with malformed JSON to cgiserver.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > System Info > Firmware VersionCheck Version:
curl -s http://CAMERA_IP/cgi-bin/systeminfo.cgi | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test with crafted HTTP request📡 Detection & Monitoring
Log Indicators:
- Repeated device reboots in system logs
- HTTP requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to cgiserver.cgi with StartZoomFocus parameter that is not a JSON object
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" AND body="StartZoomFocus" NOT body="StartZoomFocus":{)