CVE-2025-55637 is a critical severity (9.8) command injection in the firmware of the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, version v3.0.0.4662_2503122283. The record names no fixed firmware, so check Reolink for an update and isolate the device from untrusted networks.
What's affected
The record lists the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime on firmware v3.0.0.4662_2503122283. The flaw is in the function setddns_pip_system(), which handles dynamic DNS settings. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network reachable, low complexity, no privileges and no user interaction, with high impact.
The references are a CWE definition page and a researcher's write-up. There is no vendor advisory in the record and we did not confirm a fixed firmware version. Check the Reolink support page for your model and read the firmware release notes.
The CVE is not on the CISA KEV list.
How to check if you're exposed
- Open the Reolink app or client, go to the device settings and read the firmware version.
- Compare it with v3.0.0.4662_2503122283. Devices on other builds may or may not be affected, so confirm with the vendor.
- Check whether the doorbell is reachable from outside your network, through port forwarding or UPnP on the router.
- Check whether dynamic DNS is configured on the device, since that is the feature the record names.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- Check Reolink's support site for newer firmware for this model and install it.
- Remove any port forward to the doorbell and disable UPnP on the router if you do not need it.
- Put cameras and doorbells on their own network segment, with no access to your computers or file shares.
- Turn off dynamic DNS on the device if you do not use it.
- Use a strong, unique device password and change any default credentials.
- For business use, add the device to your asset inventory so that you can find it the next time a firmware flaw is published.
Why it matters
The class is CWE-77: command injection. A setting that a person enters is passed to the operating system shell without being cleaned, so the device may run something other than what was intended. On a small embedded device, that usually means full control of it.
A doorbell sits on your network, holds video and credentials, and is rarely updated. Compromised, it can leak footage or become a foothold toward other machines. The record says little about the exact path, so we do not describe one. Segmentation limits the damage whichever way a flaw like this is reached.
Quick check
Is there a firmware fix?
The record does not name one. Check Reolink's support page for your model and read the release notes before you rely on any version.
Does a network segment help?
Yes. Isolating the device limits what it can reach if it is ever taken over, and it costs little to set up on most routers.
Sources
- https://relieved-knuckle-264.notion.site/Reolink-camera-command-injection-Ddns-username-23f437003642800f83aef6b07f914212?pvs=74 (listed in the CVE record)
- Safeguard Gold entry for CVE-2025-55637
Last reviewed: 18 October 2026.
