High severity · published Jan 26, 2021
CVE-2020-25169
The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers
7.5
CVSS
1%
EPSS
No
On KEV
Description
The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to access sensitive information, such as camera feeds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rlc-410 Firmware · Reolink
All versions, or not specified · source: NVD
RF
Rlc-422 Firmware · Reolink
All versions, or not specified · source: NVD
RF
Rlc-423 Firmware · Reolink
All versions, or not specified · source: NVD
RF
Rlc-423s Firmware · Reolink
All versions, or not specified · source: NVD
RF
Rlc-510a Firmware · Reolink
All versions, or not specified · source: NVD
RF
Rlc-520a Firmware · Reolink
All versions, or not specified · source: NVD
RF
Rln8-410 Firmware · Reolink
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25169
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25169
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02
More from Rlc-410 Firmware
7.8
CVE-2020-25173
An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access