CVE-2025-60858: Reolink Doorbell Info Disclosure Flaw

CVE-2025-60858 Overview

CVE-2025-60858 is an information disclosure vulnerability affecting the Reolink Video Doorbell Wi-Fi DB_566128M5MP_W device. The vulnerability exists because the device stores and transmits Dynamic DNS (DDNS) credentials in plaintext within its configuration files and update scripts. This insecure handling of sensitive authentication data allows attackers with network access to intercept or extract DDNS credentials, potentially leading to unauthorized access to the user's network infrastructure and associated services.

Critical Impact

Attackers can intercept plaintext DDNS credentials from network traffic or extract them from device configuration, enabling unauthorized access to user accounts and network services.

Affected Products

• Reolink Video Doorbell Wi-Fi DB_566128M5MP_W

Discovery Timeline

• 2025-10-28 - CVE-2025-60858 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-60858

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Reolink Video Doorbell Wi-Fi device improperly handles DDNS credentials by storing them without encryption in configuration files and transmitting them over the network without adequate protection. This design flaw violates fundamental security principles for handling authentication credentials in IoT devices.

The network-based attack vector means that an attacker positioned on the same network segment, or with the ability to perform man-in-the-middle attacks, can passively capture these credentials during device operations such as firmware updates or DDNS registration processes. Additionally, attackers with physical access to the device or access to device backups may be able to extract credentials directly from configuration files.

Root Cause

The root cause of this vulnerability is the failure to implement proper encryption and secure storage mechanisms for sensitive DDNS credentials. The device's firmware stores these credentials in plaintext within configuration files and update scripts, rather than using secure credential vaults or encrypted storage. Furthermore, the transmission of these credentials appears to lack TLS encryption or other transport-layer protections, exposing them during network communication.

Attack Vector

The attack can be executed through network interception by an attacker with access to the same network as the vulnerable device. The attacker can capture network traffic during DDNS operations and extract plaintext credentials. Alternatively, if an attacker gains access to the device's filesystem through other means (such as firmware extraction or exploiting another vulnerability), they can directly read the stored credentials from configuration files.

The vulnerability requires no authentication or user interaction to exploit, and can be performed remotely over the network. An attacker successfully exploiting this vulnerability gains access to the victim's DDNS credentials, which could be reused across other services or leveraged to manipulate DNS records pointing to the user's network.

Detection Methods for CVE-2025-60858

Indicators of Compromise

• Unusual network traffic patterns involving DDNS service endpoints from the doorbell device
• Unexpected DNS record changes for domains associated with the Reolink doorbell
• Evidence of unauthorized access attempts using DDNS credentials on related services
• Network packet captures showing plaintext credential transmission from the device

Detection Strategies

• Monitor network traffic from Reolink doorbell devices for unencrypted authentication data
• Implement network segmentation and IDS rules to detect plaintext credential transmission
• Review DDNS service logs for unauthorized login attempts or configuration changes
• Deploy network traffic analysis tools to identify insecure credential handling patterns

Monitoring Recommendations

• Enable logging on DDNS provider accounts to track authentication events
• Implement network monitoring on IoT VLAN segments to detect anomalous traffic
• Set up alerts for DNS record modifications on domains linked to the doorbell device
• Regularly audit device configuration exports for credential exposure

How to Mitigate CVE-2025-60858

Immediate Actions Required

• Isolate the affected Reolink Video Doorbell on a separate network segment or IoT VLAN
• Change DDNS credentials immediately if the device has been exposed to untrusted networks
• Disable DDNS functionality if not required for your deployment
• Monitor for unauthorized access to accounts that may share credentials with the DDNS service

Patch Information

Check the Reolink Download Center for firmware updates that address this vulnerability. At the time of publication, users should verify whether a patched firmware version has been released and apply it as soon as available. For detailed technical information about this vulnerability, refer to the Cybermaya Blog Post.

Workarounds

• Place the device behind a firewall that restricts outbound connections to only necessary services
• Use a VPN for remote access instead of relying on DDNS functionality
• Implement network-level encryption (such as IPsec) for traffic to and from the device
• Consider using a separate, unique DDNS account specifically for this device to limit credential reuse exposure
• Enable packet inspection on your network perimeter to detect and block plaintext credential transmission