CVE-2021-44407
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots via specially crafted HTTP requests targeting the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks could render cameras unavailable for extended periods, creating surveillance blind spots and potentially enabling physical security breaches.
Likely Case
Temporary camera reboots causing surveillance gaps of 1-2 minutes during reboot cycles, disrupting continuous monitoring.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires sending malformed JSON in HTTP requests to the cgiserver.cgi endpoint; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (check Reolink support for specific version)
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/
Restart Required: Yes
Instructions:
1. Log into camera web interface 2. Navigate to System > Maintenance 3. Check for firmware updates 4. Download and install latest firmware 5. Camera will reboot automatically
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Access Control Lists
linuxRestrict HTTP access to camera management interface to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place cameras behind firewall with strict inbound rules blocking external HTTP access
- Implement network monitoring for repeated reboot patterns or malformed HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://CAMERA_IP/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test with proof-of-concept exploit (in controlled environment)📡 Detection & Monitoring
Log Indicators:
- Repeated camera reboot events
- HTTP requests to cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi containing TestEmail parameter with non-object values
- Increased reboot-related network traffic
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi") | stats count by src_ip