CVE-2020-25173 Reolink P2P Cameras
Attackers with local network access can extract fixed cryptographic keys to compromise Reolink P2P cameras remotely.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25173?
CVE-2020-25173 is a high-severity vulnerability in Reolink RLC-4XX series, published on 26 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access
Which versions are affected by CVE-2020-25173?
It affects 7 products.
Products include Reolink Rlc-410 Firmware, Reolink Rlc-422 Firmware, Reolink Rlc-423 Firmware, Reolink Rlc-423s Firmware, Reolink Rlc-510a Firmware, Reolink Rlc-520a Firmware and 1 more.
How do I fix CVE-2020-25173?
No fix has been published for CVE-2020-25173 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25173 being exploited?
There is no known exploitation of CVE-2020-25173 in the wild and no public exploit code.
Other vulnerabilities in Reolink RLC-4XX series
Sources
Also known as GHSA-282h-4pvx-ffwg.