CVE-2025-55626

Executive Summary

CVE-2025-55626 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, running firmware version v3.0.0.4662_2503122283. This flaw allows an unauthenticated or low-privileged attacker to directly access and modify Admin-only settings and session storage, bypassing proper authorization checks. The vulnerability stems from the application’s failure to validate user permissions when accessing sensitive endpoints or objects, enabling unauthorized privilege escalation and configuration tampering. Given the device’s role in physical security and home automation, exploitation could lead to unauthorized surveillance, denial of service, or further network compromise. No public exploit code or patch is currently available, and the CVSS score remains unassigned, but the impact is considered high due to the criticality of the affected functionality.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (Admin settings and session data exposed)
• Integrity (I): High (settings can be modified)
• Availability (A): Low (potential for misconfiguration leading to DoS)
• Estimated Base Score: 8.8 (High) – based on typical IDOR impact in IoT devices

Threat Level: High. The vulnerability requires no authentication and can be exploited remotely, granting full administrative control over the doorbell’s configuration and session management.

Deep Dive & Mechanics

The Reolink Smart 2K+ Doorbell exposes RESTful API endpoints for configuration and session management. The IDOR vulnerability occurs when the application fails to enforce proper access control checks on endpoints that modify or retrieve Admin-only settings. For example, an endpoint like /api/v1/admin/settings may accept a direct object reference (e.g., a user ID or session token) without verifying that the requester has administrative privileges. An attacker can enumerate or guess valid object references (such as session IDs or configuration keys) and send crafted HTTP requests to read or write sensitive data.

The session storage, likely implemented as a server-side store or local storage, can be manipulated to escalate privileges or impersonate an admin user. By modifying the session token or user role attribute, the attacker gains persistent admin access without valid credentials.

Attack Flow:

1. Attacker identifies an unauthenticated endpoint (e.g., /api/v1/session/update).
2. Attacker sends a GET request to /api/v1/admin/settings with a manipulated session ID.
3. Server returns admin settings without verifying the session’s privilege level.
4. Attacker sends a POST request to modify settings (e.g., disable motion detection, change Wi-Fi credentials).
5. Attacker can also modify session storage to elevate their own session to admin.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable endpoint - no privilege check
@app.route('/api/v1/admin/settings', methods=['GET', 'POST'])
def admin_settings():
    session_id = request.cookies.get('session_id')
    # Directly uses session_id without verifying admin role
    user = get_user_by_session(session_id)
    if request.method == 'GET':
        return jsonify(get_admin_settings())
    elif request.method == 'POST':
        update_admin_settings(request.json)
        return 'OK'

Patched Code (Conceptual):

# Patched endpoint - privilege check added
@app.route('/api/v1/admin/settings', methods=['GET', 'POST'])
def admin_settings():
    session_id = request.cookies.get('session_id')
    user = get_user_by_session(session_id)
    if not user or user.role != 'admin':
        return jsonify({'error': 'Unauthorized'}), 403
    if request.method == 'GET':
        return jsonify(get_admin_settings())
    elif request.method == 'POST':
        update_admin_settings(request.json)
        return 'OK'

The patch adds a role check after retrieving the user from the session. Without this, any valid session (even a non-admin one) can access admin endpoints.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Reolink Smart 2K+ Doorbell on firmware v3.0.0.4662_2503122283
• Network access to the device (local or exposed via UPnP/port forwarding)
• Tooling: curl, Burp Suite, or custom Python script

Exploitation Steps:

1. Identify the device IP (e.g., via ARP scan or Shodan).
2. Enumerate endpoints using a wordlist (e.g., /api/v1/admin/settings, /api/v1/session).
3. Craft a request to access admin settings without authentication:

   curl -X GET http://<device_ip>/api/v1/admin/settings -H "Cookie: session_id=attacker_session"
   

   If the response returns admin settings, the IDOR is confirmed.
4. Modify admin settings to disable security features:

   curl -X POST http://<device_ip>/api/v1/admin/settings -H "Cookie: session_id=attacker_session" -H "Content-Type: application/json" -d '{"motion_detection": false}'
   

5. Escalate privilege by modifying session storage:

   curl -X POST http://<device_ip>/api/v1/session/update -H "Cookie: session_id=attacker_session" -d 'role=admin'
   

Expected Outcome: Full administrative control over the doorbell, including camera feed access, configuration changes, and potential pivot to internal network.

Blue Team

Detection & Response:

• Monitor for unusual HTTP requests to /api/v1/admin/* endpoints from non-admin IPs.
• Alert on repeated failed authentication attempts followed by successful admin endpoint access.
• Use network segmentation to isolate IoT devices from critical internal systems.
• Enable logging on the doorbell (if supported) and forward logs to a SIEM.
• Implement a Web Application Firewall (WAF) rule to block requests to admin endpoints without proper authentication headers.

Hunting Queries:

• Search for HTTP 200 responses to /api/v1/admin/settings from IPs not in the admin whitelist.
• Look for anomalies in session token patterns (e.g., sequential or predictable tokens).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v1/admin/settings or /api/v1/session/update without valid admin cookies.
  • Unusual POST data containing role=admin or motion_detection=false.
  • Source IPs not in the device’s admin whitelist.
• Host IOCs:
  • Modified configuration files on the doorbell (e.g., config.json with altered security settings).
  • Unexpected session tokens in logs.
• File IOCs:
  • session_store.db or similar files with tampered role fields.

Detection Engineering

YARA Rule

rule CVE_2025_55626_Reolink_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-55626 IDOR in Reolink doorbell"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55626"
    strings:
        $s1 = "/api/v1/admin/settings" ascii wide nocase
        $s2 = "/api/v1/session/update" ascii wide nocase
        $s3 = "role=admin" ascii wide nocase
        $s4 = "motion_detection" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Reolink IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting Reolink admin endpoints without proper authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: reolink
detection:
    selection:
        cs-uri-stem:
            - '/api/v1/admin/settings'
            - '/api/v1/session/update'
        cs-method: 'POST'
        cs-user-agent: '*'
    condition: selection
falsepositives:
    - Legitimate admin activity from authorized IPs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-55626 Reolink IDOR Exploitation Attempt";
    flow:to_server,established;
    content:"/api/v1/admin/settings"; http_uri;
    content:"POST"; http_method;
    sid:1000001;
    rev:1;
    reference:cve,2025-55626;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device on a separate VLAN with strict firewall rules to block inbound access from the internet.
2. Disable UPnP and port forwarding for the doorbell.
3. Change default credentials and enable two-factor authentication if available.
4. Monitor for firmware updates from Reolink and apply immediately when patched.

Long-Term Fixes:

• Reolink must implement proper access control checks on all admin endpoints, verifying user role before processing requests.
• Use cryptographically random session tokens that are not enumerable.
• Add rate limiting and anomaly detection for API endpoints.
• Conduct a security audit of all IoT device APIs.

Workaround:

• If patching is not possible, restrict network access to the doorbell to only trusted IPs and disable remote administration features.

Valters IT