CVE-2020-25169

Published: Jan 26, 2021Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to access sensitive information, such as camera feeds.

Affected (7)

Products: Reolink: Rln8 410 Firmware, Rlc 422 Firmware, Rlc 510a Firmware, Rlc 410 Firmware, Rlc 423s Firmware, Rlc 423 Firmware, Rlc 520a Firmware

7 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rln8 410 Firmware	All versions

Running on/with	Platform Versions
Reolink Rln8 410	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rlc 422 Firmware	All versions

Running on/with	Platform Versions
Reolink Rlc 422	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rlc 510a Firmware	All versions

Running on/with	Platform Versions
Reolink Rlc 510a	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rlc 410 Firmware	All versions

Running on/with	Platform Versions
Reolink Rlc 410	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rlc 423s Firmware	All versions

Running on/with	Platform Versions
Reolink Rlc 423s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rlc 423 Firmware	All versions

Running on/with	Platform Versions
Reolink Rlc 423	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Reolink Rlc 520a Firmware	All versions

Running on/with	Platform Versions
Reolink Rlc 520a	All versions

Related CWEs

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (2)

https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.