CVE-2021-44379

CVE-2021-44379 affects the Reolink RLC-410W cgiserver.cgi JSON command parser. A specially crafted HTTP request can cause the cgiserver.cgi process to reboot, compromising device availability. The issue is triggered when parsing JSON arrays where the param field is expected to be an object (e.g.,...

CVE-2021-44377

CVE-2021-44377 : Talos reports multiple denial-of-service vulnerabilities in the cgiserver.cgi JSON command parser of the Reolink RLC-410W (v3.0.0.136_20121102). A specially crafted HTTP request can cause the cgiserver.cgi process to reboot by triggering asserts when JSON parameters are not objec...

CVE-2021-44374

CVE-2021-44374 affects the Reolink RLC-410W (v3.0.0.136_20121102) with a denial-of-service in the cgiserver.cgi JSON command parser. A specially crafted HTTP body can trigger an assertion when a JSON element in param is not an object, potentially rebooting the device. The issue is caused by parsi...

CVE-2021-44372

CVE-2021-44372 affects Reolink RLC-410W (v3.0.0.136_20121102). The issue resides in the cgiserver.cgi JSON command parser; a crafted HTTP request can trigger a reboot by exploiting the SetLocalLink parameter not being an object. The DoS can reboot the device, with exploitation described in Talos ...

CVE-2021-44371

CVE-2021-44371 affects the cgiserver.cgi JSON command parser in reolink RLC-410W (v3.0.0.136_20121102). A crafted HTTP POST body can trigger the parser to reboot the device, causing a denial of service. The vulnerability stems from the code paths that assume param is an object, leading to an asse...

CVE-2021-44369

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetNtp param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44370

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44369

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetNtp param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44370

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44368

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetNetPort param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44367

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetUpnp param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44365

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetDevName param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44361

The CVE-2021-44361 affects Reolink RLC-410W (v3.0.0.136_20121102), specifically the cgiserver.cgi JSON command parser. A vulnerability in JSON body handling (param not object) can cause the cgiserver.cgi process to fail its heartbeat and reboot the device, enabling a denial-of-service impact with...

CVE-2021-44359

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetCrop param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44359

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetCrop param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44358

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44358

CVE-2021-44358 affects Reolink RLC-410W (cgiserver.cgi JSON command parser). A specially crafted HTTP request can trigger a reboot (DoS) via the SetRec parameter handling when the JSON element is not an object. Connected documents corroborate a family of DoS variants for the cgiserver.cgi API (mu...

CVE-2021-44358

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. SetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44407: Improper Input Validation

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. TestEmail param is not object. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44402: Improper Input Validation

A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. GetPtzSerial param is not object. An attacker can send an HTTP request to trigger this vulnerability...