CVE-2021-44355

Vulnerability

The vulnerability resides in the JSON command parser of cgiserver.cgi in Reolink RLC-410W firmware version v3.0.0.136_20121102. Improper input validation (CWE-20) allows a specially crafted HTTP request to kill the cgiserver.cgi process, leading to a device reboot. The API intended for administrator-initiated reboot is reachable without proper authentication [1].

Exploitation

An attacker can send a crafted HTTP request to the device over the network without any authentication or user interaction. The request triggers the vulnerability in the JSON parser, causing the cgiserver.cgi process to crash and the device to reboot [1].

Impact

Successful exploitation results in denial of service (device reboot), causing temporary loss of surveillance functionality. The impact is high availability impact, with no confidentiality or integrity impact. The CVSSv3 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) [1].

Mitigation

As of the advisory publication date (2022-04-14), no fixed version was available. Users should monitor Reolink for firmware updates. The device may be vulnerable to other similar CVEs listed in the same advisory. No workaround is mentioned, and the vulnerability is not listed on CISA KEV [1].