CVE-2021-44403

CVE-2021-44403 affects Reolink RLC-410W (v3.0.0.136_20121102) and is triggered via the cgiserver.cgi JSON command parser. The vulnerability allows a specially crafted HTTP request to reboot the device due to improper handling of JSON elements; specifically, the GetPtzTattern parameter is not an o...

CVE-2021-44403

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. GetPtzTattern param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44402

CVE-2021-44402 affects the Reolink RLC-410W (v3.0.0.136_20121102) and is caused by a flaw in the cgiserver.cgi JSON command parser. A crafted HTTP request can trigger an assert when the API parses the JSON body, causing the cgiserver.cgi process to reboot the device and potentially disrupt servic...

CVE-2021-44400

CVE-2021-44400 is a denial-of-service flaw in Reolink RLC-410W (v3.0.0.136_20121102) cgiserver.cgi JSON command parser. A specially crafted HTTP body can trigger an assertion crash during JSON parsing when a param is not an object (e.g., GetPtzPatrol), forcing the cgiserver.cgi process to crash a...

CVE-2021-44399

The CVE-2021-44399 issue affects Reolink RLC-410W (v3.0.0.136_20121102) through the cgiserver.cgi JSON command parser. TALOS describes multiple DoS vectors where a specially crafted HTTP request can cause the cgiserver.cgi process to reboot by triggering asserts when the API’s JSON parameters are...

CVE-2021-44397

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. rtmp=start param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44398

The CVE-2021-44398 issue affects Reolink RLC-410W (v3.0.0.136_20121102) and is caused by a flaw in the cgiserver.cgi JSON command parser. The TALOS analysis describes multiple DoS scenarios where a specially crafted HTTP request can trigger the reboot by asserting on non-object JSON elements in c...

CVE-2021-44395

CVE-2021-44395 affects the Reolink RLC-410W camera (firmware v3.0.0.136_20121102). The vulnerability lies in the cgiserver.cgi JSON command parser: when a JSON array body contains a non-object for the param field (e.g., a misformatted or empty string), the code can trigger an assertion and reboot...

CVE-2021-44393

CVE-2021-44393 affects Reolink RLC-410W (v3.0.0.136_20121102). The vulnerability exists in cgiserver.cgi JSON command parser: processing a specially crafted HTTP POST body can reboot the device due to improper handling when JSON elements like GetIsp are not objects. Multiple sources (Talos, NVD/N...

CVE-2021-44392

The CVE-2021-44392 family affects Reolink RLC-410W (v3.0.0.136_20121102) via the cgiserver.cgi JSON command parser. A specially crafted HTTP POST body containing a JSON array can trigger an assertion in the param parsing, potentially killing the cgiserver.cgi process and rebooting the device (DoS...

CVE-2021-44391

The CVE-2021-44391 issue affects Reolink RLC-410W (firmware v3.0.0.136_20121102) where the cgiserver.cgi JSON command parser mishandles non-object GetEnc param data, allowing a remote attacker to reboot the device via a specially crafted HTTP request. TALOS details confirm a set of JSON-command-b...

CVE-2021-44388

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. Login param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44389

CVE-2021-44389 affects Reolink RLC-410W (v3.0.0.136_20121102). The cgiserver.cgi JSON command parser accepts JSON arrays of commands; if a param is not an object, the code can hit an assertion path leading to a device reboot. Attack surface involves a crafted HTTP POST to the camera’s API (cmd, a...

CVE-2021-44385

CVE-2021-44385 affects the Reolink RLC-410W camera. The vulnerability lies in the cgiserver.cgi JSON command parser: processing a specially crafted HTTP body can trigger the cgiserver.cgi to reboot the device, causing a denial of service. The issue stems from how the parser handles the JSON eleme...

CVE-2021-44386

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetPtzPatrol param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44386

The CVE-2021-44386 family affects Reolink RLC-410W (firmware v3.0.0.136_20121102) via the cgiserver.cgi JSON command parser. A crafted HTTP request can crash the device by sending a JSON array where param is not an object, causing the cgiserver.cgi heartbeat to fail and the device to reboot (DoS)...

CVE-2021-44383

CVE-2021-44383 describes a denial-of-service in the Reolink RLC-410W cgiserver.cgi JSON command parser. A specially-crafted HTTP body (JSON array of commands) can cause the cgiserver.cgi process to reboot, due to parsing assumptions that each param is an object. TALOS details show high-severity i...

CVE-2021-44381

The CVE-2021-44381 entry concerns Reolink RLC-410W firmware (v3.0.0.136_20121102). A vulnerability in cgiserver.cgi’s JSON command parser allows a specially crafted HTTP request to reboot the device, by triggering an assertion when a JSON param is not an object (notably SetPowerLed). TALOS detail...

CVE-2021-44382

CVE-2021-44382 describes a denial-of-service in the cgiserver.cgi JSON command parser of Reolink RLC-410W (v3.0.0.136_20121102). A crafted HTTP body targeting the CGI API can cause the cgiserver.cgi process to reboot, by exploiting improper handling of the JSON param object (not object) in multip...

CVE-2021-44379

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetAutoMaint param is not object. An attacker can send an HTTP request to trigger this vulnerability...