CVE-2025-55637
📋 TL;DR
This CVE describes a command injection vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell firmware that allows attackers to execute arbitrary commands on the device. The vulnerability exists in the setddns_pip_system() function and affects users running firmware version 3.0.0.4662_2503122283.
💻 Affected Systems
- Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing remote code execution, persistent backdoor installation, lateral movement to other network devices, and potential data exfiltration.
Likely Case
Attackers gain shell access to the device, can modify camera settings, disable security features, or use the device as a pivot point for network attacks.
If Mitigated
Limited impact if device is isolated in a separate VLAN with strict network segmentation and egress filtering.
🎯 Exploit Status
Exploitation requires network access to the device's management interface. The vulnerability is in DDNS username parameter injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Reolink support portal for firmware updates
2. Download latest firmware if available
3. Upload firmware via device web interface
4. Reboot device after update
🔧 Temporary Workarounds
Disable DDNS functionality
allTurn off DDNS service to prevent exploitation of the vulnerable function
Network segmentation
allIsolate IoT devices in separate VLAN with restricted access
🧯 If You Can't Patch
- Segment device in isolated network zone with no internet access
- Implement strict firewall rules blocking all inbound traffic to device management ports
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at Settings > System > FirmwareCheck Version:
Not applicable - check via device web interfaceVerify Fix Applied:
Verify firmware version is newer than v3.0.0.4662_2503122283📡 Detection & Monitoring
Log Indicators:
- Unusual DDNS configuration changes
- Shell command execution in system logs
- Multiple failed authentication attempts to device
Network Indicators:
- Unusual outbound connections from IoT device
- Traffic to unexpected ports from device
- DDNS requests with suspicious parameters
SIEM Query:
source="iot-device" AND (event="ddns_update" OR event="system_command") AND command="*;*" OR command="*|*" OR command="*`*"