CVE-2021-44417
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted HTTP request to the Reolink RLC-410W camera's cgiserver.cgi JSON parser. When exploited, it triggers a device reboot, disrupting camera functionality. Only users of the affected Reolink camera model with vulnerable firmware are impacted.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent device reboots rendering the camera unusable, potentially disrupting security monitoring and creating windows for physical intrusion.
Likely Case
Temporary camera downtime during reboot cycles, interrupting video feeds and recording capabilities.
If Mitigated
Minimal impact if device is patched or network access is properly restricted.
🎯 Exploit Status
The vulnerability requires sending a malformed JSON parameter (GetAlarm) via HTTP request, which is trivial to automate. Public exploit details are available in the Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for updated firmware
Vendor Advisory: https://reolink.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into Reolink camera web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Download latest firmware from Reolink website. 4. Upload and apply firmware update. 5. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to camera management interface
Firewall Rules
linuxBlock external HTTP access to camera on port 80/443
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate camera on separate VLAN with strict firewall rules
- Disable remote web interface access and use only local network management
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > Device InformationCheck Version:
curl -s http://camera-ip/cgi-bin/cgiserver.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Confirm firmware version is newer than v3.0.0.136_20121102 and test with crafted HTTP request to verify no reboot occurs📡 Detection & Monitoring
Log Indicators:
- Multiple device reboot events in system logs
- HTTP requests with malformed JSON to cgiserver.cgi
Network Indicators:
- HTTP POST requests to /cgi-bin/cgiserver.cgi with GetAlarm parameter
- Unusual reboot patterns from camera IP
SIEM Query:
source="camera_logs" AND (event="reboot" OR uri="/cgi-bin/cgiserver.cgi") | stats count by src_ip