CVE-2021-44413
📋 TL;DR
A denial-of-service vulnerability in Reolink RLC-410W cameras allows attackers to cause device reboots by sending specially crafted HTTP requests to the cgiserver.cgi JSON parser. This affects Reolink RLC-410W v3.0.0.136_20121102 firmware users, potentially disrupting surveillance operations.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent device reboots causing extended surveillance downtime, potentially enabling physical security breaches during camera outages.
Likely Case
Temporary camera unavailability requiring manual reboot, disrupting real-time monitoring and recording capabilities.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires sending malformed JSON via HTTP POST to cgiserver.cgi; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.0.148_21102905 or later
Vendor Advisory: https://reolink.com/security-advisory/
Restart Required: Yes
Instructions:
1. Log into camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Upload latest firmware from Reolink website. 4. Apply update and allow camera to reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with strict firewall rules blocking external HTTP access.
Access Control Lists
linuxImplement IP-based restrictions allowing only authorized management systems to access camera web interface.
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disable remote web interface access and use only local network management.
- Implement rate limiting on HTTP requests to camera IP addresses.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > System Info > Firmware Version. If version is v3.0.0.136_20121102 or earlier, device is vulnerable.Check Version:
curl -s http://[CAMERA_IP]/cgi-bin/cgiserver.cgi?cmd=GetDevInfo | grep FirmwareVersionVerify Fix Applied:
Confirm firmware version is v3.0.0.148_21102905 or later after update. Test by attempting to send malformed JSON POST request to /cgi-bin/cgiserver.cgi - device should not reboot.📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP 400/500 errors from cgiserver.cgi
- Unexpected device reboot logs in system events
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with malformed JSON payloads
- Unusual traffic patterns to camera web interface
SIEM Query:
source="camera_logs" AND (uri="/cgi-bin/cgiserver.cgi" AND status>=400) OR event="reboot"