CVE-2021-44409
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted HTTP request to the cgiserver.cgi JSON command parser in affected Reolink RLC-410W cameras. The vulnerability causes the device to reboot when the TestWifi parameter is not properly validated as an object. This affects users of Reolink RLC-410W cameras with vulnerable firmware.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render the camera unavailable for extended periods, disrupting surveillance coverage.
Likely Case
Attackers cause temporary camera reboots, creating surveillance gaps of 1-2 minutes during reboot cycles.
If Mitigated
With proper network segmentation and access controls, impact is limited to internal network disruption only.
🎯 Exploit Status
Simple HTTP POST request with malformed JSON can trigger the vulnerability. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later than v3.0.0.136_20121102
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Download and install latest firmware. 5. Reboot camera after update completes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate camera network from untrusted networks and internet
Access Control Lists
linuxRestrict HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place cameras on isolated VLAN with strict firewall rules
- Disable web interface if not required for operation
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface at System > Device InformationCheck Version:
curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=getDevInfo | grep versionVerify Fix Applied:
Confirm firmware version is newer than v3.0.0.136_20121102 and test with crafted HTTP request📡 Detection & Monitoring
Log Indicators:
- Unexpected camera reboots
- HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON
Network Indicators:
- HTTP POST to camera IP port 80 with TestWifi parameter not as JSON object
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi")