CVE-2025-55625

Executive Summary

CVE-2025-55625 is a disputed open redirect vulnerability in Reolink firmware version v4.54.0.4.20250526. The vulnerability allows an attacker to craft a URL that, when visited by an authenticated or unauthenticated user, redirects the user to an arbitrary external domain. The supplier (Reolink) disputes the finding, stating that the redirection is intentional to support Alexa integration, where Alexa URLs may change domains. However, from a security perspective, any open redirect that can be weaponized for phishing, credential harvesting, or malware distribution represents a significant risk, especially in IoT devices that often have limited security controls. The CVSS score is 4.3 (Medium) due to the requirement for user interaction and the limited impact on confidentiality and integrity.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a firmware-level issue in Reolink’s embedded web server.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed to trigger the redirect.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Changed (S:C) – The redirect can lead to a different security domain.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible via phishing.
• Integrity Impact: Low (I:L) – The redirect can modify the user’s perceived content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the disputed nature and lack of a patch increase the risk. Attackers can use this for targeted phishing campaigns against Reolink users.

Deep Dive & Mechanics

The vulnerability resides in the web server component of Reolink firmware v4.54.0.4.20250526. The server accepts a redirect or url parameter (exact parameter name not publicly disclosed) and, without proper validation, redirects the user to the specified URL. The supplier claims this is intentional for Alexa integration, where the device needs to redirect to Alexa’s authentication endpoints. However, the implementation does not restrict the redirect to a whitelist of allowed domains, allowing any arbitrary URL.

Attack Flow:

1. An attacker crafts a malicious URL: http://<reolink-ip>/cgi-bin/api.cgi?cmd=Login&redirect=https://evil.com/phishing
2. The attacker sends this link to a victim via email, SMS, or social media.
3. The victim, who may be a Reolink user, clicks the link.
4. The Reolink device processes the request and issues an HTTP 302 redirect to https://evil.com/phishing.
5. The victim’s browser follows the redirect, landing on the attacker’s phishing site, which may mimic the Reolink login page.

Root Cause: Lack of input validation and absence of a URL whitelist for redirect destinations.

Vulnerable vs. Patched Code

Since no official patch has been released, the vulnerable code is the current production firmware. A hypothetical patched version would include a whitelist of allowed redirect domains (e.g., *.alexa.com, *.amazon.com) and reject any URL not matching the whitelist.

Vulnerable Code (Conceptual):

# Vulnerable: No validation
def handle_redirect(request):
    target = request.GET.get('redirect')
    return redirect(target)

Patched Code (Conceptual):

# Patched: Whitelist validation
ALLOWED_DOMAINS = ['alexa.com', 'amazon.com', 'reolink.com']

def handle_redirect(request):
    target = request.GET.get('redirect')
    from urllib.parse import urlparse
    parsed = urlparse(target)
    if parsed.netloc in ALLOWED_DOMAINS or parsed.netloc.endswith('.alexa.com'):
        return redirect(target)
    else:
        return HttpResponseBadRequest("Invalid redirect target")

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Reolink device with firmware v4.54.0.4.20250526 (or any affected version).
• Attacker machine with a web server to host a phishing page.
• Victim machine with a browser.

Exploitation Steps:

1. Identify the Reolink device IP (e.g., via Shodan or local network scan).
2. Craft the malicious URL: http://<reolink-ip>/cgi-bin/api.cgi?cmd=Login&redirect=http://attacker.com/phishing
3. Send the URL to the victim via email or social engineering.
4. When the victim clicks, they are redirected to the attacker’s phishing page.
5. The phishing page can capture credentials or other sensitive data.

Proof of Concept (Python):

import requests

target_ip = "192.168.1.100"
malicious_url = f"http://{target_ip}/cgi-bin/api.cgi?cmd=Login&redirect=http://evil.com/phishing"
print(f"Send this link to victim: {malicious_url}")
response = requests.get(malicious_url, allow_redirects=False)
print(f"Redirect status: {response.status_code}")
print(f"Location header: {response.headers.get('Location')}")

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests to Reolink devices with unusual redirect parameters.
• Look for redirect responses (HTTP 302) from Reolink devices to external domains.
• Use network traffic analysis to detect outbound connections from Reolink devices to unknown domains.

Mitigation:

• Block outbound connections from Reolink devices to untrusted domains at the firewall.
• Implement URL filtering to prevent users from clicking on suspicious links.
• Educate users about phishing attacks targeting IoT devices.

Indicators of Compromise (IOCs)

• URL Pattern: http://<reolink-ip>/cgi-bin/api.cgi?cmd=Login&redirect=<external-url>
• HTTP Response: 302 Found with Location header pointing to an external domain.
• Network Traffic: Outbound HTTP/HTTPS connections from Reolink IP to unknown domains.
• Log Entries: Web server logs showing redirect parameter with non-whitelisted URLs.

Detection Engineering

YARA Rule

rule CVE_2025_55625_Open_Redirect {
    meta:
        description = "Detects open redirect attempts against Reolink devices"
        author = "Valters IT"
        date = "2025-06-10"
        cve = "CVE-2025-55625"
    strings:
        $redirect_param = "redirect=" nocase
        $reolink_path = "/cgi-bin/api.cgi" nocase
        $cmd_login = "cmd=Login" nocase
    condition:
        all of them
}

Sigma Rule

title: Reolink Open Redirect Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Reolink devices with a redirect parameter pointing to an external domain
author: Valters IT
date: 2025/06/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "redirect=http://"
            - "redirect=https://"
        cs-uri-stem|contains: "/cgi-bin/api.cgi"
        cs-method: "GET"
    condition: selection
falsepositives:
    - Legitimate Alexa integration redirects
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55625 Reolink Open Redirect Attempt"; flow:to_server; content:"/cgi-bin/api.cgi"; http_uri; content:"redirect="; http_uri; pcre:"/redirect=(http|https):\/\//Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Access: If not required, disable remote access to the Reolink device from the internet.
2. Firewall Rules: Block outbound connections from the Reolink device to any domain not in a whitelist (e.g., *.alexa.com, *.amazon.com).
3. User Education: Inform users about the risk of clicking on links that appear to come from Reolink devices.

Long-Term Fix:

• Reolink must release a firmware update that implements a strict URL whitelist for redirect destinations.
• Until a patch is available, consider using a reverse proxy (e.g., Nginx) in front of the Reolink device to filter and validate redirect parameters.

Workaround:

• If Alexa integration is not used, disable the feature entirely via the device settings.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert