CVE-2026-57473

Executive Summary

CVE-2026-57473 is a critical security vulnerability affecting Reolink Home Hub devices running firmware versions prior to v3.3.0.456_26031911. The flaw resides in the netclient and factory services, which lack adequate brute-force protection mechanisms. This allows an attacker on the same local network to systematically guess credentials, intercept traffic between the Hub and its associated cameras, and ultimately compromise the credentials of connected cameras. The vulnerability has a CVSS score of 0.0 (placeholder) and no public proof-of-concept or exploit code has been released. The vendor has provided a patch in firmware version v3.3.0.456_26031911.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary IoT device. The supply chain risk is limited to the physical device and its firmware update process.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability description, a reasonable assessment is:

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same local network as the Hub.
• Attack Complexity (AC): Low (L) – Brute-forcing is straightforward.
• Privileges Required (PR): None (N) – No prior authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – Compromising the Hub can affect the security of connected cameras.
• Confidentiality (C): High (H) – Camera credentials and traffic can be exposed.
• Integrity (I): High (H) – An attacker could potentially modify camera settings or inject malicious data.
• Availability (A): Low (L) – The attack primarily targets confidentiality and integrity, not availability.

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The attack is feasible for any actor with local network access, and the impact on privacy and security is severe.

Deep Dive & Mechanics

The vulnerability is rooted in the netclient and factory services of the Reolink Home Hub. These services are responsible for initial device setup, network configuration, and communication with Reolink cameras.

Mechanism:

1. Service Exposure: The netclient and factory services listen on network ports (likely TCP/UDP) for incoming connections from cameras and management tools.
2. Lack of Rate Limiting: These services do not implement any form of rate limiting, account lockout, or CAPTCHA after multiple failed authentication attempts.
3. Brute-Force Attack: An attacker on the same local network can send a high volume of authentication requests to these services, systematically trying different username/password combinations.
4. Credential Compromise: Once the correct credentials are discovered, the attacker can authenticate to the Hub.
5. Traffic Interception: With authenticated access, the attacker can intercept and decrypt (or simply read) the traffic between the Hub and its connected cameras. This traffic may contain video feeds, camera configuration data, and other sensitive information.
6. Camera Compromise: The attacker can then use the compromised Hub to further attack the cameras, potentially gaining full control over them.

The vulnerability is particularly dangerous because it requires no prior access to the device and can be executed with simple scripting tools.

Vulnerable vs. Patched Code

Since the exact source code is proprietary, we can infer the difference based on the patch description.

Vulnerable Code (Conceptual):

# Vulnerable netclient service
def authenticate(username, password):
    # No rate limiting or lockout
    if check_credentials(username, password):
        return True
    else:
        return False

Patched Code (Conceptual):

# Patched netclient service
import time
from collections import defaultdict

failed_attempts = defaultdict(int)
lockout_time = 300  # 5 minutes
max_attempts = 5

def authenticate(username, password):
    current_time = time.time()
    if failed_attempts[username] >= max_attempts:
        if current_time - last_failed_time[username] < lockout_time:
            return False  # Account locked
        else:
            failed_attempts[username] = 0  # Reset after lockout period
    
    if check_credentials(username, password):
        failed_attempts[username] = 0
        return True
    else:
        failed_attempts[username] += 1
        last_failed_time[username] = current_time
        return False

The patched version introduces a rate-limiting mechanism that locks an account after a certain number of failed attempts for a specified duration.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Hardware: Reolink Home Hub (vulnerable firmware), Reolink camera, attacker machine (Kali Linux).
2. Network: All devices on the same local network (e.g., 192.168.1.0/24).
3. Tools: nmap, hydra, wireshark, custom Python script.

Exploitation Steps:

1. Discovery: Scan the local network for the Reolink Hub.

   nmap -p 1-65535 192.168.1.0/24
   

2. Identify Services: Look for open ports associated with netclient and factory services (e.g., TCP 9000, UDP 1900).
3. Brute-Force: Use hydra to brute-force credentials.

   hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.100 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
   

   Note: The exact form parameters will depend on the service's API.
4. Intercept Traffic: Once authenticated, use wireshark or tcpdump to capture traffic between the Hub and cameras.

   tcpdump -i eth0 host 192.168.1.100 and port 554
   

5. Extract Credentials: Analyze the captured traffic to extract camera credentials.

Blue Team (Defender)

Detection & Response:

1. Network Monitoring: Monitor for excessive failed authentication attempts to the Hub's IP address.
2. Log Analysis: Enable and review logs on the Hub (if available) for multiple failed login events.
3. Anomaly Detection: Look for unusual traffic patterns, such as a single IP address making hundreds of connection attempts to the Hub in a short period.
4. Immediate Actions:
   • Isolate the affected Hub from the network.
   • Change all camera passwords.
   • Apply the firmware patch.
   • Conduct a forensic analysis of the Hub and cameras.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of TCP/UDP connection attempts to the Hub's IP address on ports used by netclient and factory services.
  • Repeated failed authentication responses from the Hub.
  • Unusual traffic from the Hub to external IPs (if attacker exfiltrates data).
• Host IOCs (on Hub):
  • Log entries showing multiple failed login attempts from the same source IP.
  • Unauthorized configuration changes.
  • New, unknown devices connected to the Hub.
• File IOCs:
  • Presence of brute-force tools (e.g., hydra, medusa) on any machine that has accessed the network.

Detection Engineering

YARA Rule

rule Detect_Reolink_BruteForce_Attempts {
    meta:
        description = "Detects multiple failed authentication attempts to Reolink Home Hub"
        author = "Valters IT"
        date = "2026-10-27"
        reference = "CVE-2026-57473"
    strings:
        $failed_auth = "Authentication failed" ascii wide nocase
        $login_attempt = "Login attempt" ascii wide nocase
    condition:
        #failed_auth > 10 or #login_attempt > 10
}

Sigma Rule

title: Reolink Home Hub Brute-Force Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple failed authentication attempts to Reolink Home Hub
author: Valters IT
date: 2026/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-57473
logsource:
    category: application
    product: reolink
    service: netclient
detection:
    selection:
        EventID: 4625  # Windows failed logon (if applicable)
        TargetUserName: 'admin'
        WorkstationName: 'ReolinkHub'
    condition: selection | count() by SourceIp > 10 within 5m
falsepositives:
    - Legitimate misconfigured clients
level: high

Suricata Rule

alert tcp $HOME_NET any -> $REOLINK_HUB_IP 9000 (msg:"Reolink Home Hub Brute-Force Attempt"; flow:to_server; content:"POST"; http_method; content:"/login"; http_uri; content:"pass="; http_client_body; threshold:type both, track by_src, count 10, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update the Reolink Home Hub firmware to version v3.3.0.456_26031911 or later.
2. Network Segmentation: Place the Hub and cameras on a separate VLAN with strict firewall rules to limit access from other devices.
3. Change Credentials: Immediately change all passwords for the Hub and connected cameras.
4. Disable Unused Services: If possible, disable the netclient and factory services when not in use.

Long-Term Mitigations:

1. Enable Logging: Ensure the Hub logs all authentication attempts and forwards them to a SIEM.
2. Implement MFA: If supported, enable multi-factor authentication for administrative access.
3. Regular Audits: Conduct periodic security audits of IoT devices on the network.
4. Vendor Communication: Report any similar vulnerabilities to the vendor and monitor for future patches.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert