CVE-2021-1422: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

A denial of service vulnerability (CVE-2021-40405) exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.136_20121102. The vulnerability was discovered by Francesco Benvenuto of Cisco Talos and publicly disclosed on January 26, 2022. A specially-crafted HTTP request can lead to a device reboot, affecting the Reolink RLC-410W WiFi security camera (Talos Report).

The vulnerability stems from a logic error in how the cgiserver.cgi checks user permissions for the Upgrade API. When permission check fails, the device sets the perform_reboot flag, which leads to a device reboot, effectively allowing non-authorized users to trigger the reboot operation. The vulnerability has been assigned a CVSS v3.0 score of 7.7 (High) with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (Talos Report).

When successfully exploited, this vulnerability allows an attacker to cause a denial of service condition by forcing the device to reboot. While this requires a logged-in user by default, when combined with CVE-2021-40404 (TALOS-2021-1420), it's possible to perform this API call without authentication, elevating the potential impact (Talos Report).

The vulnerability can be triggered by sending an HTTP request to the affected device. When combined with the authentication bypass vulnerability (CVE-2021-40404), the attack can be executed without authentication, making it more severe with a chained CVSS score of 8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) (Talos Report).

The vendor has released a patch for this vulnerability on January 19, 2022. Users are advised to update their Reolink RLC-410W devices to the latest firmware version to address this security issue (Talos Report).