Posts made by user_612681119584296_612681119584296

I purchased two of these cameras with solar panels. I saw a review tonight saying they do not support reolink NVRs or other software like Blue Iris. This is NOT listed anywhere on the site and is a game changer. IE I will be sending both back. Can someone please advise if theirs work? Thanks.

@user_612681119584296_612681119584296

I think I might have gotten to the bottom of the 56v PSU too. I think someone might have picked up the 12v one and then inadvertently returned the 56v one. Cant say that for sure though but having that there to begin with could explain some configuration issues I had getting to the NVR via the network. I will probably configure the thing tonight if I get some spare time. We will see.

@user_612681119584296_612681119584296

I am still looking into this. I brought up the NVR on about 300 inch screen today and showed some folks the basic workings of an NVR. I looked at a few settings and I think I can fix the problem with my NVR taking over the cameras and not being able to access them from other NVRs. That being said I think I need to add each camera a static IP not only in the GUI for each camera but in the DHCP server. Shouldnt be like that but again you shouldnt be able to plug up one thing and take over everything with a certain name brand. As far as the power supply I dont know it is a POE power supply that I would like to explain by someone picking one up and bringing the wrong one back but I have the propper 12v one plugged in now. We will see.

@ks so I found out some more stuff. Apparently, yes the NVR will basically do a man in the middle attack if you connect it to a network using DHCP. Even though the lease has not expired and the NVR is not the DHCP server. I can plan for that and that is basically a preventable thing. The safest thing would be to set up the network only to allow certain macs. Yes you can get around that but whatever.

I have basically had the NVR sitting until I could figure this stuff out. I have to give a class tomorrow on very basic video recovery from DVRs and NVRs. I hooked up my unconfigured RLN36 thinking it would be perfect since the last few DVR/NVRs I have seen have been reolink. I get a flicker of the power LEDs and nothing on the display. Recently, I had someone bring in a HD connected to a big box unit that would not spin up. In that case they had an improper 19v PSU plugged into a 12v system. I checked the PSU that came with mine and it was a 56V power supply. Hooked a 12v one in and everything booted up fine. So good on Reolink for have voltage protection. The only thing I can think was they sent the 56v PSU with the NVRs not realizing they are not POE.

So, I am going to give a really good class tomorrow about what to expect to find and not find with NVR/DVR setups.

@joseph-chircop_497308027822318

It should not be able to take over the cameras. Reolink support has responded to my above thread.

Will manually sitting the IP address on the camera fix this problem? Because if the device has an address from DHCP it should not change unless the DHCP server that sat it changes it. This is essentially imitating a man in the middle attack but the cameras are designed to let it happen. I just want an option to cut it off. The chances of a person exploiting this is low IE if they gain physical access to an ethernet cable they could just feed it 96v DC and probably force shut down most POE switches. But I really would like to eliminate it.

As I explained in this thread that is now being ignored...

https://community.reolink.com/topic/4446/rln36-kills-all-my-camers-major-security-flaw-found?post_id=18907&_=1673150083648

I purchased a new NVR system. All of my cameras were on a dedicated VLAN and have specific IP addresses plugged in. I purchased the NVR as a backup and hopefully a replacement for my power hungry Blueiris NVR. I powered the thing on and connected it to my dedicated VLAN. One by one every recent REOLINK branded camera went dark despite the device not having a user name and password for any of them. All of them had a static DHCP address assigned but yet this off the shelf NVR hijacked all of them and took them offline.

I get that it makes the system easier to configure cameras for new people to but there has to be an option to turn this feature off. It has to use a workaround to take over the cameras. I keep replying to the original thread and I have stopped getting responses. If I can hook up a $200 NVR to a system with cameras having passwords and they simply roll over and change their IPs then it is very easy to conclude people can exploit this issue.

If you arnt going to fix it at least explain which port I need to block to prevent someone from sending a command and completely circumventing my configuration.

@user_612681119584296_612681119584296

Still going on another month and no reply. No acknowledgement of the security flaw. An off the shelf NVR was connected to the same VLAN as my REOLINK cameras and took every single one of them offline and assigned them new IP addresses.

This was despite the fact they already had assigned IP addresses on the network.

This is a classic man in the middle attack. All new REOLINK cameras are susceptible to this.

I guess we are not going to get an answer to the issue about the security flaw in your cams?

@bitteroldmann_504481637408946

Two things I have noticed. 1) The newer cameras do not seem to attract spiders like my older ones for some reason. The RL823 I have will also burn the hell out of you with the IR. I found this out the hard way and I suspect the bugs dont like it. 2) I also have automated lights around my home. I have all 60watt equivalent LEDs in the exterior fixtures that are connected to dimming. When an exterior door is opened they go to full brightness for five minutes and then back to 10% after. I also had some invidible fences setup but I hadnt quite figured out the keyframes withing with Blue Iris and homeseer so they are turned off. By having external visible LED bulbs on my house I feel it deters people from walking up and hanging out. The spiders also tend to like those better. I just have to powerwash the house every year.

@sasuke This is what I did.

I am even considering doing this inside my garage.

@reolink-fiona

That isnt my issue. The thing is connected fine. I have a VLAN just for my camera system and that where I connect the NVR to one of the POE ports because it is isolated from the home network VLAN. I then connect the lan port on the NVR to my home network. That part is fine and I could configure the cameras individually if I want to but there should be a way to do it remotely.

My issue is the major security flaw with the cameras. They all have a different passwords and specific network IP addresses I have set for them. However, when I plug in a brand new NVR with none of my credentials on them it still manages to override the settings on the camera and bypass my DHCP server changing the IP address of each camera to something outside of what I want it to be at. This is a major security flaw. These cameras should have no ability to reassign IP addresses without a user name and password. In their current state someone could go to any house or business with a reolink camera installed and simply unplug a camera or gather some other physical access to the system and take over the entire camera system. This is a major flaw.

@user_612681119584296_612681119584296

Looking at the logs it has apparently provided a different IP address, login, and passcode to each camera. I never gave the NVR credentials to connect to them? This is a major security issue!!!! There should never be a feature on any manufactures cameras that allows a device to bypass DHCP and reassign IP addresses to the thing without the login and password from the admin. Luckily it resets the cameras when you power cycle the POE port but it still does not change the fact that plugging in the device into the network completely overides the user name and password and changes the IP address.

So, what protocol is the NVR using to do this? Other than just plugging up a reolink NVR to a network of reolink cameras what command can someone on the network send to the cameras to just cause this? Is there a way to turn this off and when are you all planning on releasing firmware upgrades to fix this giant security flaw?

Also, I am glad my camera VLAN is airgapped because this flaw could be used to remotely disable cameras too. Someone really screwed the pooch on this one.

So I have posted before about getting some more Reolink products namely the RLN36 so I can hopefully transition from a power hungry blue iris server to a new platform. Well I purchased a RLN36 and got around to hooking it up tonight.

All of my cameras are paired with blue iris and every single Reolink camera went offline the second I turned on the new NVR. I cant access the cameras individually from the mobile app or web browser. I am about to try and shut the NVR down and see what happens but the fact this happened at all is disturbing. Yes there is no 100% certain way to guard a independent vlan with wires going into the field. So what you are telling me is that someone only has to purchase a Reolink NVR and either attach it physically or gain access to a wifi network on the same VLAN and completely cripple a system? Why is this a thing? This is a major security flaw.

Meanwhile there seems to be no option for me to add cameras remotely to the thing. So I have to physically drag a monitor out to where I have it hooked up and configure each camera with that little mouse the thing came with???

I assume this is the same for the US market since it is all probably north america?

I just got two of your tracking 4k duel sensor cams shipped that were back ordered. So I am thinking this is going to be soon rather than later. Whenever the container ship can probably dock and unload which is probably a surprise for everyone.

How do you like the client? I have been waiting on the 36 channel NVR but I am wondering if using the client might help with automation.

@rob_456660318671017 they have free NVR software that from what I understand runs on windows and supports ONVIF cameras. I haven't tried it because I also run Blue Iris. However the motion detection on the cameras is spot on and with it would throw a ONVIF trigger on event therefor you could start recording. I am also looking at the possibility of running a FTP server VM on my NAS so it can throw the files from SD card on it and then just delete after 30 days.

@reolink-fiona I am in the US. Central East Coast region.

Hi, I am new to the forum but not video security. I started out in 2007 with several home usb cameras and moved to analog cameras in a PC with capture cards running zoneminder. I eventually went to a duel CPU windows server Blue Iris setup which has served me eell. I upgraded that over the years from 720p cameras to 1080p and now Reolink 4k cameras are filtering in. The server hardware was upgraded to a Raided Dell R410 with a combined total of 12 cores. I am also running one 48port UBNT POE switch and hope to go to a second. I have customized blue iris for motion detection and it works pretty well and now does motion detection on the substream saving CPU cycles. Here is the thing. The new Reolink detection is better and has no hit on the server CPU usage because it is done on the camera.

While looking around online I found the upcoming RLN36. Awesome ideas since I already have a POE network segmented into a video VLAN that runs on a 10g backbone.

So what is the timeline for this and how do the alarm ports work? Can I tie it into an automation system with those?

IE I would love to save some electricity and just run the two CPUs in a fileserver with maybe blue iris temporarily running without motion detection on the reolink cameras and just push alerts to a hosted FTP server. Thoughts?