Reolink Home Hub EUVD-2026-39646

Exploitation requires the attacker to be on the same local network segment (Wi-Fi or LAN) as the Reolink Home Hub - remote internet-based exploitation is not possible given AV:A. The attacker must additionally be able to intercept network traffic between the Hub and its cameras, as reflected by AT:P in the CVSS 4.0 vector; passive sniffing or ARP poisoning satisfies this requirement. The affected firmware versions must be prior to v3.3.0.456_26031911. No authentication to the Hub is required by the attacker (PR:N), and no user interaction is needed (UI:N). Exploitation is limited by: physical or network proximity to the target environment, the need to successfully brute-force captured credential material (introducing time/compute cost), and the absence of internet-reachable attack surface. The vulnerability does not affect the Hub's own system directly; impact is limited to credentials and control of cameras managed by the Hub.

Real-world risk is moderate but context-dependent. The CVSS 4.0 base score of 5.8 correctly reflects meaningful constraints: AV:A limits exploitation to attackers already on the same local network (Wi-Fi or LAN segment), and AT:P signals that a specific precondition - traffic interception - must be satisfied. No EPSS data was provided in the intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public POC is identified. Despite these constraints, the subsequent-system impact (SC:H/SI:H/SA:H) is significant: successful exploitation yields full control over connected cameras, including potential live video feed access and camera manipulation. For typical residential deployments, exploitation requires an adversary with physical or wireless proximity to the home network, meaningfully raising the bar. In higher-risk environments - shared networks (apartments, offices using consumer IoT), or networks with guest access - the adjacent-network requirement is easier to satisfy. The missing EPSS score and absence of vendor CVSS 3.1 vector are data gaps that limit finer risk calibration.

An attacker connected to the same Wi-Fi network as the Reolink Home Hub - such as a guest network participant or a compromised device on the LAN - passively captures traffic between the Hub and its cameras using standard packet capture tools. The attacker extracts credential material from the netclient or factory service communications and applies offline brute-force techniques to recover plaintext camera credentials. With credentials in hand, the attacker gains authenticated access to the connected cameras, enabling live video surveillance, camera reconfiguration, or pivot into the broader home network. No public POC exists at time of analysis, but the attack requires only commodity tooling once network adjacency is established.