CVE-2025-55624

Executive Summary

CVE-2025-55624 is an intent redirection vulnerability affecting Reolink firmware version 4.54.0.4.20250526. This flaw allows unauthorized attackers to invoke internal functions or access non-public components of the Reolink application, potentially leading to privilege escalation, data leakage, or unauthorized control of the device. The vulnerability resides in the Android application's intent handling mechanism, where insufficient validation of incoming intents enables malicious applications to redirect intents to internal components. As of the latest analysis, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for targeted attacks.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, likely due to incomplete or missing vector information. Based on the vulnerability type (intent redirection), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires a malicious app installed on the same device.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no prior authentication needed.
• User Interaction (UI): Required (R) – user must install the malicious app.
• Scope (S): Unchanged (U) – the vulnerable component is the app itself.
• Confidentiality (C): High (H) – internal functions and non-public components can be accessed.
• Integrity (I): High (H) – unauthorized actions can be performed.
• Availability (A): Low (L) – potential for denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Estimated Base Score: 7.3 (High)

Threat Level: High – due to the potential for complete compromise of the Reolink device and associated data.

Deep Dive & Mechanics

Intent redirection vulnerabilities occur when an Android application exposes an activity, service, or broadcast receiver that accepts intents from external sources without proper validation. In the context of Reolink v4.54.0.4.20250526, the application likely registers an intent filter for a custom action or scheme. A malicious application can craft an intent that mimics a legitimate request, causing the Reolink app to redirect the intent to an internal component (e.g., an activity that handles sensitive operations like camera control, account management, or file access).

The attack flow:

1. The attacker installs a malicious app on the same Android device as the Reolink app.
2. The malicious app sends a crafted intent to the Reolink app's exported component.
3. The Reolink app processes the intent without verifying its origin or content.
4. The intent is redirected to an internal component, granting the attacker unauthorized access.

This can lead to:

• Unauthorized access to camera feeds.
• Modification of device settings.
• Extraction of stored credentials or tokens.
• Execution of privileged operations.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely resembles:

// Vulnerable: No validation of incoming intent
Intent intent = getIntent();
String action = intent.getAction();
if (action.equals("com.reolink.action.INTERNAL")) {
    // Redirect to internal component
    startActivity(new Intent(this, InternalActivity.class));
}

A patched version would include checks:

// Patched: Validate source and permissions
Intent intent = getIntent();
String action = intent.getAction();
if (action.equals("com.reolink.action.INTERNAL")) {
    // Check if the intent came from a trusted source
    if (isTrustedCaller(intent)) {
        startActivity(new Intent(this, InternalActivity.class));
    } else {
        // Log and reject
        Log.w("Security", "Unauthorized intent from " + getCallingPackage());
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Android device or emulator running Reolink v4.54.0.4.20250526.
• Android Studio or similar IDE for building malicious app.
• ADB (Android Debug Bridge) for installation and debugging.

Exploitation Steps:

1. Create a malicious Android app with an activity that sends a crafted intent.
2. In the malicious app's AndroidManifest.xml, declare an activity that launches the exploit.
3. In the activity's onCreate() method, construct and send the intent:

Intent exploitIntent = new Intent();
exploitIntent.setAction("com.reolink.action.INTERNAL");
exploitIntent.setComponent(new ComponentName("com.reolink.app", "com.reolink.app.ExportedActivity"));
startActivity(exploitIntent);

4. Install the malicious app on the target device.
5. Launch the malicious app to trigger the intent redirection.
6. Observe unauthorized access to internal functions (e.g., camera feed, settings).

Note: No public exploit code is available; this is a theoretical approach based on the vulnerability description.

Blue Team

Detection:

• Monitor for unusual intent patterns using Android's dumpsys or logging.
• Check for apps requesting permissions to send intents to Reolink components.
• Use static analysis tools to identify exported components in the Reolink APK.

Mitigation:

• Restrict app installation to trusted sources only.
• Use Android's permission model to limit intent delivery.
• Implement runtime checks for intent origin.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): Unknown (no malicious samples available).
• Network Indicators: Unusual outbound connections from the Reolink app to unexpected IPs.
• Behavioral Indicators:
  • Reolink app accessing internal components without user interaction.
  • Unexpected camera activation or settings changes.
  • Log entries showing unauthorized intent redirection attempts.
• Process Indicators: Malicious app with package name mimicking Reolink or using generic names.

Detection Engineering

YARA Rule

rule CVE_2025_55624_Intent_Redirection {
    meta:
        description = "Detects potential intent redirection exploitation in Reolink app"
        author = "Valters IT"
        date = "2025-06-01"
        reference = "CVE-2025-55624"
    strings:
        $intent_action = "com.reolink.action.INTERNAL"
        $exported_component = "ExportedActivity"
        $vulnerable_version = "4.54.0.4.20250526"
    condition:
        $intent_action or $exported_component or $vulnerable_version
}

Sigma Rule

title: Reolink Intent Redirection Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-55624 via intent redirection
author: Valters IT
date: 2025-06-01
logsource:
    product: android
    service: logcat
detection:
    selection:
        - EventID: "Intent"
        - Action: "com.reolink.action.INTERNAL"
        - Component: "com.reolink.app.ExportedActivity"
    condition: selection
falsepositives:
    - Legitimate Reolink app operations
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55624 Reolink Intent Redirection Exploit"; flow:to_server,established; content:"com.reolink.action.INTERNAL"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Exported Components: If possible, modify the Reolink app's manifest to remove exported components or add permission checks.
2. Restrict App Installation: Only install apps from trusted sources (Google Play Store).
3. Monitor Logs: Enable verbose logging for the Reolink app to detect suspicious intent activity.

Long-term Fix:

• Vendor Patch: Await an official update from Reolink that validates intent origins and restricts access to internal components.
• Code Hardening: Implement permission checks and signature verification for all exported components.

Workarounds:

• Use Android's "App Pinning" feature to prevent other apps from interacting with Reolink.
• Uninstall the Reolink app until a patch is available.

Valters IT
Securing Digital Frontiers