PT-2022-12055 · Reolink · Reolink Rlc-410W

Francesco Benvenuto · Published 2022-01-28 · Updated 2022-10-25 · CVE-2021-44358

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions reolink RLC-410W version 3.0.0.136 20121102

Description A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The SetRec param is not an object, allowing an attacker to send an HTTP request and exploit this issue.

Recommendations For version 3.0.0.136 20121102, consider disabling the cgiserver.cgi JSON command parser functionality until a patch is available to prevent exploitation. Restrict access to the vulnerable SetRec param to minimize the risk of a denial of service attack.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-44358

Affected Products

Reolink Rlc-410W

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44358 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44358 · Vendor Advisory
• https://t.me/cibsecurity/36543 · Telegram Post
• https://t.me/cvenotify/25996 · Telegram Post