CVE-2022-21796
📋 TL;DR
This CVE describes a memory corruption vulnerability in Reolink RLC-410W IP cameras that allows attackers to execute arbitrary code via specially crafted HTTP requests. The vulnerability affects the netserver parse_command_list functionality and can lead to complete system compromise. Only users of affected Reolink camera models running vulnerable firmware are impacted.
💻 Affected Systems
- Reolink RLC-410W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device takeover, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Device compromise allowing camera feed interception, credential theft, and use as pivot point for internal network attacks.
If Mitigated
Limited impact if device is isolated in separate VLAN with strict firewall rules and no internet exposure.
🎯 Exploit Status
The vulnerability requires sending crafted HTTP requests to the device's web interface, which is relatively straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for latest firmware updates
Vendor Advisory: https://support.reolink.com/hc/en-us/articles/360049010514
Restart Required: Yes
Instructions:
1. Log into Reolink web interface. 2. Navigate to System > Maintenance > Firmware Upgrade. 3. Download latest firmware from Reolink website. 4. Upload and install firmware. 5. Device will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras in separate VLAN with strict firewall rules
Access Control
linuxBlock external HTTP access to camera management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Remove internet exposure - ensure cameras are not accessible from the internet
- Implement strict network segmentation with firewall rules blocking all unnecessary traffic to cameras
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System > Device Information > Firmware VersionCheck Version:
curl -s http://camera-ip/cgi-bin/api.cgi?cmd=GetDevInfo | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v3.0.0.136_20121102 and test HTTP request handling📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to camera web interface
- Multiple failed authentication attempts followed by successful exploit
Network Indicators:
- HTTP requests with malformed command lists to camera IPs
- Unusual outbound connections from camera devices
SIEM Query:
source="camera-logs" AND (http_uri="*parse_command_list*" OR http_user_agent="*nmap*" OR http_user_agent="*metasploit*")