CVE-2020-25173
📋 TL;DR
Reolink P2P cameras use a hardcoded cryptographic key that can be extracted by attackers on the local network. This allows attackers to potentially compromise cameras remotely even without local network access. Only Reolink P2P camera models with this fixed key implementation are affected.
💻 Affected Systems
- Reolink P2P cameras
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full remote control of cameras, enabling video/audio interception, device manipulation, and using cameras as footholds into internal networks.
Likely Case
Unauthorized remote access to camera feeds and device settings, potentially enabling surveillance or disabling security monitoring.
If Mitigated
Limited to local network reconnaissance only, with no external compromise possible due to proper network segmentation.
🎯 Exploit Status
Attack requires local network access initially, but key extraction is straightforward. Public research demonstrates the vulnerability clearly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released by Reolink (check specific model for exact version)
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02
Restart Required: Yes
Instructions:
1. Identify exact camera model. 2. Visit Reolink support site. 3. Download latest firmware for your model. 4. Upload firmware via camera web interface or Reolink client. 5. Reboot camera after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Disable P2P Feature
allTurn off P2P functionality in camera settings if available
🧯 If You Can't Patch
- Physically disconnect cameras from internet while keeping local network access for monitoring
- Implement strict firewall rules blocking all inbound traffic to cameras
🔍 How to Verify
Check if Vulnerable:
Check firmware version against Reolink's advisory. Older firmware versions are vulnerable.Check Version:
Check via camera web interface: Settings > System > Information > Firmware VersionVerify Fix Applied:
Confirm firmware version matches or exceeds patched version listed in advisory📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Firmware modification logs
- Unexpected configuration changes
Network Indicators:
- Unexpected outbound connections from cameras
- Traffic to unfamiliar external IPs
- Protocol anomalies in camera communications
SIEM Query:
source="camera_logs" AND (event="firmware_update" OR event="config_change")