PT-2022-12089 · Reolink · Reolink Rlc-410W

Francesco Benvenuto · Published 2022-01-28 · Updated 2022-10-25 · CVE-2021-44392

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions reolink RLC-410W version 3.0.0.136 20121102

Description A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The GetImage param is not an object, allowing an attacker to send an HTTP request to exploit this issue.

Recommendations For version 3.0.0.136 20121102, consider restricting access to the cgiserver.cgi JSON command parser functionality until a fix is available. Avoid using the GetImage param in HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-44392

Affected Products

Reolink Rlc-410W

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44392 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44392 · Vendor Advisory