CVE-2025-60858

Executive Summary

CVE-2025-60858 exposes a critical security flaw in the Reolink Video Doorbell Wi-Fi model DB_566128M5MP_W. The device stores and transmits DDNS (Dynamic DNS) credentials in plaintext within its configuration and update scripts. This vulnerability allows an attacker with network access or physical access to the device’s file system to extract sensitive credentials, potentially leading to unauthorized access to the DDNS provider account and further network compromise.

Affected Component: Reolink Video Doorbell Wi-Fi DB_566128M5MP_W firmware and configuration scripts.

Root Cause: The device does not encrypt or obfuscate DDNS credentials (username/password) when storing them in configuration files or transmitting them during update processes.

Impact: An attacker can intercept or extract plaintext DDNS credentials, enabling them to:

• Hijack the DDNS hostname.
• Redirect traffic intended for the doorbell.
• Potentially pivot to other devices on the same network.
• Gain persistent access to the device’s cloud management interface.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex steps are required.
• Privileges Required (PR): None (N) – No authentication is needed to exploit.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Plaintext credentials are exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Base Score: 7.5 (High)

Threat Level: High. The ease of exploitation and the potential for credential reuse make this a significant risk.

Deep Dive & Mechanics

The vulnerability resides in the device’s configuration management system. The Reolink Video Doorbell uses DDNS to maintain a static hostname for remote access. The DDNS credentials (username and password) are stored in plaintext in configuration files, typically located in /etc/config/ or similar paths. Additionally, these credentials are transmitted in plaintext during firmware update processes or when the device communicates with the DDNS provider.

Attack Vectors:

1. Network Sniffing: An attacker on the same network can capture unencrypted traffic containing DDNS credentials.
2. File System Access: If an attacker gains physical access or exploits another vulnerability (e.g., command injection), they can read the configuration files directly.
3. Man-in-the-Middle (MitM): An attacker can intercept the plaintext credentials during update or configuration synchronization.

Technical Details:

• The device uses a script (e.g., ddns_update.sh) that reads credentials from a configuration file.
• The configuration file (e.g., ddns.conf) contains lines like:

  username=admin
  password=plaintext_password
  

• No encryption or hashing is applied to these values.

Vulnerable vs. Patched Code

Vulnerable Code (Example from ddns.conf):

# Vulnerable: Plaintext storage
DDNS_USERNAME="admin"
DDNS_PASSWORD="secret123"

Patched Code (Hypothetical):

# Patched: Encrypted storage
DDNS_USERNAME="admin"
DDNS_PASSWORD="$(decrypt_aes 'encrypted_base64_string')"

The patched version would use AES encryption or a secure vault to store credentials, decrypting them only when needed.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Reolink Video Doorbell DB_566128M5MP_W.
2. Connect it to a local network with a monitoring machine (e.g., Kali Linux).
3. Enable DDNS in the device’s web interface.

Exploitation Steps:

1. Network Sniffing:

   • Use tcpdump or Wireshark to capture traffic from the device.
   • Filter for HTTP or plaintext protocols (e.g., tcp port 80).
   • Look for POST requests containing username and password fields.

   tcpdump -i eth0 host <device_ip> -A | grep -E "username|password"
   

2. File System Extraction (if physical access):

   • Connect to the device via UART or SSH (if enabled).
   • Navigate to the configuration directory:

     cat /etc/config/ddns.conf
     

3. Exploit Script (Python):

   import requests
   # Assuming the device exposes a configuration endpoint
   url = "http://<device_ip>/cgi-bin/config.cgi"
   response = requests.get(url, auth=('admin', ''))
   print(response.text)  # May contain plaintext credentials
   

Blue Team

Detection:

• Monitor for unusual network traffic from the device, especially plaintext HTTP requests.
• Use network intrusion detection systems (NIDS) to flag unencrypted credential transmission.

Hunting:

• Search for logs indicating access to configuration files or unusual API calls.
• Check for unauthorized SSH or UART connections to the device.

Mitigation:

• Isolate the device on a separate VLAN.
• Disable DDNS if not required.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

Network IOCs:

• Plaintext HTTP requests containing username and password fields.
• Traffic to known DDNS providers (e.g., dyndns.org, no-ip.com) without TLS.

File System IOCs:

• Presence of configuration files with plaintext credentials:
  • /etc/config/ddns.conf
  • /tmp/ddns_creds.txt
• Unauthorized access to /etc/config/ directory.

Behavioral IOCs:

• Unexpected changes to DDNS hostname.
• Unusual outbound connections from the device to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_60858_Reolink_DDNS_Credentials {
    meta:
        description = "Detects plaintext DDNS credentials in Reolink Video Doorbell configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60858"
    strings:
        $s1 = "DDNS_USERNAME=" ascii wide nocase
        $s2 = "DDNS_PASSWORD=" ascii wide nocase
        $s3 = "username=" ascii wide nocase
        $s4 = "password=" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Reolink Video Doorbell Plaintext DDNS Credentials
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic containing plaintext DDNS credentials from Reolink Video Doorbell
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - http.request.body contains "username="
        - http.request.body contains "password="
        - http.request.body contains "DDNS_USERNAME"
        - http.request.body contains "DDNS_PASSWORD"
    condition: selection
falsepositives:
    - Legitimate DDNS updates from other devices
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60858 Reolink Video Doorbell Plaintext DDNS Credentials"; flow:to_server; content:"username="; http_client_body; content:"password="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable DDNS on the device if not essential.
2. Change DDNS credentials immediately and use a unique, strong password.
3. Isolate the device on a separate VLAN with strict firewall rules.

Long-Term Fix:

• The vendor (Reolink) must release a firmware update that encrypts DDNS credentials at rest and in transit.
• Implement secure storage mechanisms (e.g., encrypted configuration files, hardware security modules).

Workarounds:

• Use a VPN instead of DDNS for remote access.
• Monitor network traffic for plaintext credential leaks.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.