CVE-2025-55630: Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.3 High.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 22 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, organizations and users should first verify if a firmware update or patch is available from Reolink addressing this issue and apply it promptly. In the absence of an official patch, users should consider the following practical steps: 1) Disable remote access to the device unless absolutely necessary, restricting management interfaces to trusted local networks. 2) Implement network segmentation to isolate IoT devices from critical business systems, limiting lateral movement opportunities. 3) Enforce strong, unique passwords for all device accounts to reduce the risk of successful brute force attacks following username enumeration. 4) Monitor device logs and network traffic for repeated failed login attempts indicative of enumeration or brute force activity. 5) Where possible, enable multi-factor authentication or additional access controls to strengthen authentication security. 6) Consider replacing vulnerable devices with alternatives that follow secure authentication practices if patching is not feasible. 7) Educate users about the risks of credential reuse and phishing attacks that could be facilitated by leaked username information.
Description
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to enumerate existing accounts.