CVE-2026-57473: Reolink Home Hub Auth Bypass Vulnerability

CVE-2026-57473 Overview

CVE-2026-57473 affects the netclient and factory services in Reolink Home Hub firmware versions prior to v3.3.0.456_26031911. The vulnerability enables adjacent-network attackers to brute-force credentials used between the Hub and connected cameras. Successful exploitation lets an attacker intercept traffic and compromise camera credentials on the same local network. The weakness is classified under CWE-1391, covering use of weak credentials. Nozomi Networks published the coordinated advisory documenting the flaw.

Critical Impact
Adjacent-network attackers can brute-force the credential exchange between the Reolink Home Hub and paired cameras, then intercept video traffic and take over camera accounts.

Affected Products

Reolink Home Hub firmware versions prior to v3.3.0.456_26031911
netclient service on the Reolink Home Hub
factory service on the Reolink Home Hub

Discovery Timeline

2026-06-26 - CVE-2026-57473 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57473

Vulnerability Analysis

The Reolink Home Hub exposes two internal services, netclient and factory, that participate in provisioning and communicating with paired cameras. Both services rely on credentials whose key space is small enough to brute-force within a practical time window. An attacker positioned on the same Wi-Fi or wired LAN segment can observe the credential exchange and iterate candidate values against captured material until a match is found. Once the credentials are recovered, the attacker decrypts or replays Hub-to-camera traffic and authenticates directly to associated cameras. The flaw maps to [CWE-1391] (Use of Weak Credentials), reflecting insufficient credential strength rather than a memory-safety or injection defect.

Root Cause

The root cause is weak credential generation and validation in the netclient and factory services. The credentials protecting Hub-to-camera communication lack sufficient entropy, allowing offline or online brute-force cracking. There is no rate limiting or credential hardening that would defeat exhaustive guessing.

Attack Vector

Exploitation requires adjacent-network access, meaning the attacker must reside on the same local network as the Home Hub. The attacker sniffs traffic between the Hub and cameras, then performs credential guessing against the observed protocol material. No user interaction and no prior authentication are required. Successful exploitation compromises confidentiality, integrity, and availability of the subsequent camera system, per the CVSS 4.0 vector.

No public exploit or proof-of-concept has been published. The vulnerability is described in prose in the Nozomi Networks Vulnerability Advisory.

Detection Methods for CVE-2026-57473

Indicators of Compromise

Unexpected devices associated with the LAN segment hosting the Reolink Home Hub, particularly hosts capturing multicast or broadcast traffic.
Repeated authentication attempts or high-volume connections targeting the Hub's netclient or factory service ports.
Camera accounts showing logins from local IP addresses that do not correspond to the Hub itself.

Detection Strategies

Inspect wireless controller logs for unauthorized clients on the SSID or VLAN that hosts Reolink devices.
Deploy passive network monitoring to flag brute-force patterns against the Hub's service ports.
Correlate camera authentication events with Hub activity to identify direct camera access that bypasses the Hub.

Monitoring Recommendations

Enable and forward Reolink Home Hub logs, if available, to a centralized log platform for review.
Monitor DHCP and ARP tables on the IoT VLAN for new or unexpected MAC addresses.
Alert on sustained traffic between unknown local hosts and the Home Hub outside of expected mobile-app usage windows.

How to Mitigate CVE-2026-57473

Immediate Actions Required

Update every Reolink Home Hub to firmware v3.3.0.456_26031911 or later.
Segment Reolink cameras and Hubs onto a dedicated VLAN or SSID with no lateral access from user devices.
Restrict Wi-Fi access to trusted clients and rotate the wireless pre-shared key if untrusted devices may have connected.

Patch Information

Reolink addressed the issue in Home Hub firmware v3.3.0.456_26031911. Refer to the Nozomi Networks Vulnerability Advisory for the coordinated disclosure details and vendor fix references.

Workarounds

Isolate the Home Hub on an IoT-only network segment with no bridged access from guest or user Wi-Fi.
Disable Wi-Fi features on the Hub where feasible and use wired connectivity to reduce sniffing exposure.
Rotate any camera credentials that may have been in use prior to patching, and re-pair cameras to the Hub after the update.

bash

# Configuration example: isolate Reolink devices on a dedicated VLAN
# (example using generic Linux/iptables syntax)
iptables -A FORWARD -i vlan_iot -o vlan_user -j DROP
iptables -A FORWARD -i vlan_user -o vlan_iot -j DROP