CVE-2021-44389

CVE-2021-44389 affects Reolink RLC-410W (v3.0.0.136_20121102). The cgiserver.cgi JSON command parser accepts JSON arrays of commands; if a param is not an object, the code can hit an assertion path leading to a device reboot. Attack surface involves a crafted HTTP POST to the camera’s API (cmd, a...