Details of VAR-202201-0816

ID

VAR-202201-0816

CVE

CVE-2021-44354

TITLE

Reolink RLC-410W cgiserver.cgi Denial of Service Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2022-12815

DESCRIPTION

Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability. Reolink Rlc-410W is a Wifi security camera from China Reolink company. Reolink RLC-410W has a denial of service vulnerability in version v3.0.0.136_20121102. The vulnerability is caused by the fact that the JSON parsing function of cgiserver.cgi does not properly handle the input error message. Attackers can use this vulnerability to cause application denial of service

Trust: 1.53

sources: NVD: CVE-2021-44354 // CNVD: CNVD-2022-12815 // VULMON: CVE-2021-44354

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-12815

AFFECTED PRODUCTS

vendor:	reolink	model:	rlc-410w	scope:	eq	version:	3.0.0.136_20121102	Trust: 1.0
vendor:	reolink	model:	rlc-410w 3.0.0.136 20121102	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2022-12815 // NVD: CVE-2021-44354

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-44354
value:	HIGH
Trust: 1.0
talos-cna@cisco.com:	CVE-2021-44354
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2022-12815
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202201-2461
value:	HIGH
Trust: 0.6
VULMON:	CVE-2021-44354
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-44354
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
CNVD:	CNVD-2022-12815
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-44354
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
talos-cna@cisco.com:	CVE-2021-44354
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	4.0
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2022-12815 // VULMON: CVE-2021-44354 // CNNVD: CNNVD-202201-2461 // NVD: CVE-2021-44354 // NVD: CVE-2021-44354

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.0

sources: NVD: CVE-2021-44354

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-2461

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202201-2461

PATCH

title:

Patch for Reolink RLC-410W cgiserver.cgi Denial of Service Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/319031

Trust: 0.6

sources: CNVD: CNVD-2022-12815

EXTERNAL IDS

db:	NVD	id:	CVE-2021-44354	Trust: 2.3
db:	TALOS	id:	TALOS-2021-1421	Trust: 2.3
db:	CNVD	id:	CNVD-2022-12815	Trust: 0.6
db:	CNNVD	id:	CNNVD-202201-2461	Trust: 0.6
db:	VULMON	id:	CVE-2021-44354	Trust: 0.1

sources: CNVD: CNVD-2022-12815 // VULMON: CVE-2021-44354 // CNNVD: CNNVD-202201-2461 // NVD: CVE-2021-44354

REFERENCES

url:	https://talosintelligence.com/vulnerability_reports/talos-2021-1421	Trust: 2.9
url:	https://cxsecurity.com/cveshow/cve-2021-44354/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/20.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2022-12815 // VULMON: CVE-2021-44354 // CNNVD: CNNVD-202201-2461 // NVD: CVE-2021-44354

CREDITS

Discovered by Francesco Benvenuto of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-202201-2461

SOURCES

db:	CNVD	id:	CNVD-2022-12815
db:	VULMON	id:	CVE-2021-44354
db:	CNNVD	id:	CNNVD-202201-2461
db:	NVD	id:	CVE-2021-44354

LAST UPDATE DATE

2024-11-23T21:33:18.835000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-12815	date:	2022-02-21T00:00:00
db:	VULMON	id:	CVE-2021-44354	date:	2022-04-21T00:00:00
db:	CNNVD	id:	CNNVD-202201-2461	date:	2022-04-22T00:00:00
db:	NVD	id:	CVE-2021-44354	date:	2024-11-21T06:30:46.030

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-12815	date:	2022-02-21T00:00:00
db:	VULMON	id:	CVE-2021-44354	date:	2022-04-14T00:00:00
db:	CNNVD	id:	CNNVD-202201-2461	date:	2022-01-26T00:00:00
db:	NVD	id:	CVE-2021-44354	date:	2022-04-14T20:15:09.193