Reolink Security flaw CVE-2019-11001 and iLnkP2P

iceblade

Hello,

I have a RCL-511W with hardware version IPC_51516M5M,
There are 2 vulnerabilities reported recently, one for Reolink IP cameras:
https://nvd.nist.gov/vuln/detail/CVE-2019-11001

And a generic one for camera's using iLnkP2P:
https://hacked.camera/

my questions:
1) Is there an estimated time when there will be a fix available for my specific model? (since there are no firmware upgrades mentioned for my model on the firmware download page at all, since the availability of the RCL-511W)

2) Does Reolink use iLnkP2P as its P2P protocol, or does it use its own or different version? E.g. is it vulnerable to this attack or not?

3) There are no firmware updates mentioned for the 5MP RCL-511W / IPC_51516M5M, since its release last year, yet there were several security related firmware updates for the older models. either your writing very good software since the RCL-511W version, or no firmware patches are being created for this particular system. Or atleast they are not mentioned on the firmware download page. I did find one for harware model IPC_51516M, but since mine is a IPC_51516M5M i did not dare to apply that one. Could you point me to where i can find the latest firmware for my specific hardware version?

Thank you for your time in advance!

Kind Regards,
R

Carl

We've published the new firmware for your camera recently. You can go to download center to upgrade the firmware for your RLC-511W. You don't need to worry about the vulnerabilities threat, our camera is very safe to use. The new firmware will modify the bugs, please upgrade firmware for your camera. If you have other problems during operation, please feel free to contact support@reolink.com for further assistance. Thank you for supporting Reolink.

iceblade

Hello,

Thank you for your reply,

So am i correct to assume that a firmware update for hardware IPC_51516M will not break anything when loading that firmware version on my hardware device which is IPC_51516M5M ? (note the added 5M on my hardware device)

I have installed the version from the page you mentioned, and can confirm that this firmware update contains version 1.0.239, where as the CVS vulnerability was up to version 1.0.227

One question that was unanswered:
Does Reolink use iLnkP2P or its own mechanism, and is its P2P implementation vulnerable to the mentioned P2P Hearbeat attack mentioned here: https://hacked.camera/ or not?

Kind Regards,
R