CVE-2025-56800
📋 TL;DR
This vulnerability allows local attackers to bypass the lock screen authentication in Reolink desktop applications by modifying client-side JavaScript. It affects users of Reolink desktop software who have enabled the lock screen feature. The vendor disputes the severity since exploitation requires local access to modify the application.
💻 Affected Systems
- Reolink Desktop Application
📦 What is this software?
Reolink by Reolink
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access to a logged-in workstation could bypass the lock screen and gain unauthorized access to the Reolink application and connected camera feeds.
Likely Case
Local users with basic technical knowledge could bypass their own lock screen to access the application without proper authentication.
If Mitigated
With proper physical security controls and user awareness, the impact is minimal since exploitation requires local access to the system.
🎯 Exploit Status
Exploitation requires local access to modify JavaScript files. Public proof-of-concept demonstrates patching the a.settingsManager.lockScreenPassword property.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Reolink for updated version
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Open Reolink desktop application
2. Navigate to Settings > About
3. Check for updates and install latest version
4. Restart the application
🔧 Temporary Workarounds
Disable Lock Screen Feature
allTemporarily disable the lock screen functionality until patched
Application Sandboxing
allRun Reolink application in restricted/sandboxed environment to prevent file modification
🧯 If You Can't Patch
- Implement strict physical security controls for workstations running Reolink
- Disable lock screen feature and rely on operating system authentication instead
🔍 How to Verify
Check if Vulnerable:
Check if running version 8.18.12 or earlier with lock screen enabled. Examine JavaScript files for client-side password storage.Check Version:
In Reolink application: Settings > About > VersionVerify Fix Applied:
Verify application version is updated beyond 8.18.12. Test lock screen functionality to ensure proper server-side validation.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Reolink application
- Modification of application resource files
Network Indicators:
- Unusual camera access patterns from previously locked workstations
SIEM Query:
Process creation events for Reolink executable followed by file modification events in application directories