CVE-2021-44373

Vulnerability

The cgiserver.cgi JSON command parser in Reolink RLC-410W firmware version v3.0.0.136_20121102 does not properly validate the SetAutoFocus parameter when it is not an object. This improper input validation (CWE-20) allows a specially crafted HTTP request to crash the cgiserver.cgi process, resulting in a device reboot. [1]

Exploitation

An unauthenticated attacker with network access to the device can send a crafted HTTP request with a malformed SetAutoFocus parameter (e.g., a non-object value) to the vulnerable endpoint. No authentication or user interaction is required, and the attack can be executed remotely over the network. [1]

Impact

Successful exploitation causes the cgiserver.cgi process to terminate, leading to an immediate reboot of the camera. This results in a denial of service, rendering the device temporarily unavailable. No confidentiality or integrity impact is involved; only availability is affected. [1]

Mitigation

As of the publication date of this advisory (2022-01-28), no official fix or firmware update has been disclosed by Reolink for this vulnerability. Users are advised to monitor vendor security advisories for a patch. If possible, restrict network access to the camera to trusted networks only. [1]