CVE-2021-44378

CVE-2021-44378 affects Reolink RLC-410W (v3.0.0.136_20121102) via the cgiserver.cgi JSON command parser. A specially crafted HTTP request can trigger an assertion in param parsing, killing the cgiserver.cgi process and rebooting the device (DoS/availability impact). Root cause: improper handling ...

CVE-2021-44379

CVE-2021-44379 affects the Reolink RLC-410W cgiserver.cgi JSON command parser. A specially crafted HTTP request can cause the cgiserver.cgi process to reboot, compromising device availability. The issue is triggered when parsing JSON arrays where the param field is expected to be an object (e.g.,...

CVE-2021-44377

CVE-2021-44377 : Talos reports multiple denial-of-service vulnerabilities in the cgiserver.cgi JSON command parser of the Reolink RLC-410W (v3.0.0.136_20121102). A specially crafted HTTP request can cause the cgiserver.cgi process to reboot by triggering asserts when JSON parameters are not objec...

CVE-2021-44376

The CVE-2021-44376 entry covers a denial-of-service vulnerability in the cgiserver.cgi JSON command parser of reolink RLC-410W (v3.0.0.136_20121102). A specially crafted HTTP request can reboot the device because the parser assumes the JSON element in param is an object and asserts otherwise, cau...

CVE-2021-44374

CVE-2021-44374 affects the Reolink RLC-410W (v3.0.0.136_20121102) with a denial-of-service in the cgiserver.cgi JSON command parser. A specially crafted HTTP body can trigger an assertion when a JSON element in param is not an object, potentially rebooting the device. The issue is caused by parsi...

CVE-2021-44372

CVE-2021-44372 affects Reolink RLC-410W (v3.0.0.136_20121102). The issue resides in the cgiserver.cgi JSON command parser; a crafted HTTP request can trigger a reboot by exploiting the SetLocalLink parameter not being an object. The DoS can reboot the device, with exploitation described in Talos ...

CVE-2021-44371

CVE-2021-44371 affects the cgiserver.cgi JSON command parser in reolink RLC-410W (v3.0.0.136_20121102). A crafted HTTP POST body can trigger the parser to reboot the device, causing a denial of service. The vulnerability stems from the code paths that assume param is an object, leading to an asse...

CVE-2021-44369

CVE-2021-44369 affects reolink RLC-410W (v3.0.0.136_20121102). The issue is a denial-of-service in the cgiserver.cgi JSON command parser: sending a specially crafted HTTP request can cause the device to reboot when JSON elements (param objects) are not objects, e.g., SetNtp. Root cause: improper ...

CVE-2021-44370

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44364

CVE-2021-44364 affects the Reolink RLC-410W under vendor firmware version 3.0.0.136_20121102. The DoS arises from the cgiserver.cgi JSON command parser: a specially crafted HTTP body that uses a JSON array can trigger an assertion in the parser when a param is not an object, potentially killing t...

CVE-2021-44360

CVE-2021-44360 affects Reolink RLC-410W (v3.0.0.136_20121102). The denial-of-service stems from cgiserver.cgi JSON command parser, where a crafted HTTP body can trigger a reboot. The issue is tied to non-object param handling (e.g., SetNorm) and can be exploited via a network request without auth...

CVE-2021-44361

The CVE-2021-44361 affects Reolink RLC-410W (v3.0.0.136_20121102), specifically the cgiserver.cgi JSON command parser. A vulnerability in JSON body handling (param not object) can cause the cgiserver.cgi process to fail its heartbeat and reboot the device, enabling a denial-of-service impact with...

CVE-2021-44358

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44358

CVE-2021-44358 affects Reolink RLC-410W (cgiserver.cgi JSON command parser). A specially crafted HTTP request can trigger a reboot (DoS) via the SetRec parameter handling when the JSON element is not an object. Connected documents corroborate a family of DoS variants for the cgiserver.cgi API (mu...

CVE-2021-40423

A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.13620121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40406

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40415

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. In cgicheckability the Format API does not have a specific case, the user permission will default to 7. This will give non-administrative users the...

CVE-2021-40404

An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40406

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability...

Design/Logic Flaw

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. All the Get APIs that are not included in cgicheckability are already executable by any logged-in users. An attacker can send an HTTP request to trigger...