EUVD-2026-39646
GHSA-xmw8-pxhc-cq64
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector with high complexity for traffic interception prerequisite; no auth required; scope change to cameras with high C/I but no stated availability impact.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated cameras and compromise the credentials of connected cameras.
AnalysisAI
Credential brute-force exposure in Reolink Home Hub (versions prior to v3.3.0.456_26031911) enables adjacent-network attackers to crack authentication credentials used between the Hub and its associated cameras. The netclient and factory services transmit or store credentials in a manner susceptible to brute-force attack, allowing an adversary on the same local network to intercept Hub-to-camera traffic and recover camera credentials. No public exploit or CISA KEV listing is present at time of analysis; however, the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability, reflecting full camera compromise potential once credentials are cracked.
Technical ContextAI
Reolink Home Hub is a consumer IoT gateway device (CPE: cpe:2.3:a:reolink:home_hub:*:*:*:*:*:*:*:*) that orchestrates communication between a central hub and networked IP cameras. The vulnerability is rooted in CWE-1391 (Use of Weak Credentials), meaning the netclient and factory services rely on credentials that are insufficiently complex, improperly protected in transit, or both - making them feasible targets for brute-force recovery by an attacker who can observe local network traffic. The CVSS 4.0 vector (AV:A/AT:P) confirms that exploitation requires both adjacent-network positioning and a specific attack precondition, likely the ability to intercept Hub-to-camera protocol traffic. The split impact profile - no direct vulnerable-system impact (VC:N/VI:N/VA:N) but High subsequent-system impact (SC:H/SI:H/SA:H) - indicates the Hub itself is not the target; rather, the cameras it manages are the ultimate victims of credential compromise.
RemediationAI
The confirmed fix is upgrading Reolink Home Hub firmware to v3.3.0.456_26031911 or later, which addresses the weak credential handling in the netclient and factory services. Users should apply this firmware update through the Reolink mobile application or the device's web management interface as soon as possible. The Nozomi Networks advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-57473 should be consulted for full disclosure details. As a compensating control prior to patching, isolate the Home Hub and associated cameras on a dedicated VLAN or IoT network segment to prevent untrusted adjacent hosts from intercepting Hub-to-camera traffic; note this does not eliminate the credential weakness but reduces adversary access to the traffic stream. Additionally, disabling any unnecessary local network bridging or promiscuous-mode capable devices on the same segment reduces passive interception risk.
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the
An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firm
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with
An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal funct
An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using
Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity se
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to
A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows atta
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. Rated critica
Same weakness CWE-1391 – Use of Weak Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today