EUVD-2026-39646
GHSA-xmw8-pxhc-cq64
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector with high complexity for traffic interception prerequisite; no auth required; scope change to cameras with high C/I but no stated availability impact.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated cameras and compromise the credentials of connected cameras.
AnalysisAI
Credential brute-force exposure in Reolink Home Hub (versions prior to v3.3.0.456_26031911) enables adjacent-network attackers to crack authentication credentials used between the Hub and its associated cameras. The netclient and factory services transmit or store credentials in a manner susceptible to brute-force attack, allowing an adversary on the same local network to intercept Hub-to-camera traffic and recover camera credentials. No public exploit or CISA KEV listing is present at time of analysis; however, the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability, reflecting full camera compromise potential once credentials are cracked.
Technical ContextAI
Reolink Home Hub is a consumer IoT gateway device (CPE: cpe:2.3:a:reolink:home_hub:*:*:*:*:*:*:*:*) that orchestrates communication between a central hub and networked IP cameras. The vulnerability is rooted in CWE-1391 (Use of Weak Credentials), meaning the netclient and factory services rely on credentials that are insufficiently complex, improperly protected in transit, or both - making them feasible targets for brute-force recovery by an attacker who can observe local network traffic. The CVSS 4.0 vector (AV:A/AT:P) confirms that exploitation requires both adjacent-network positioning and a specific attack precondition, likely the ability to intercept Hub-to-camera protocol traffic. The split impact profile - no direct vulnerable-system impact (VC:N/VI:N/VA:N) but High subsequent-system impact (SC:H/SI:H/SA:H) - indicates the Hub itself is not the target; rather, the cameras it manages are the ultimate victims of credential compromise.
RemediationAI
The confirmed fix is upgrading Reolink Home Hub firmware to v3.3.0.456_26031911 or later, which addresses the weak credential handling in the netclient and factory services. Users should apply this firmware update through the Reolink mobile application or the device's web management interface as soon as possible. The Nozomi Networks advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-57473 should be consulted for full disclosure details. As a compensating control prior to patching, isolate the Home Hub and associated cameras on a dedicated VLAN or IoT network segment to prevent untrusted adjacent hosts from intercepting Hub-to-camera traffic; note this does not eliminate the credential weakness but reduces adversary access to the traffic stream. Additionally, disabling any unnecessary local network bridging or promiscuous-mode capable devices on the same segment reduces passive interception risk.
Same weakness CWE-1391 – Use of Weak Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today