(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Reolink E1 Pro
|
|
Security Grade
Calculator v1
|
Reolink E1 Pro
Release Date: 2021-05-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Local-network attackers can recover a fixed cryptographic key from P2P devices (CVE-2020-25173); this is a local compromise path rather than documented physical tampering.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Reolink P2P products do not sufficiently protect data in transit to Reolink servers (CVE-2020-25169) and the camera firmware family carries OS command injection and auth-bypass issues (CVE-2021-40404 to CVE-2021-40413).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No Reolink product is listed in CISA KEV and no public exploitation campaign against E1 Pro was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware updates are delivered via the Reolink app/Client with a public download and support knowledge base.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Cloud/P2P access via Reolink account plus separate local device credentials; no federated identity or standards-based SSO.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Streams are encrypted, but the P2P channel was assessed as insufficiently protecting data to Reolink servers and uses a fixed key, i.e. legacy rather than current practice.
|
| Storage
|
No encryption
|
🔗 Proof
|
microSD and FTP/NAS recordings are unencrypted; AES-128 at rest is only offered when footage is stored on a Reolink Home Hub.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Reolink account plus on-device users; sharing and recovery are app-driven with limited role granularity.
|
| Authentication
|
Basic
|
🔗 Proof
|
Password-based login without MFA, and an authentication bypass has been published for the cgiserver login handler (CVE-2021-40404).
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Repeated-failure lockout exists in current firmware but is not documented as configurable policy and does not cover all interfaces.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Device logs record motion alarms and some account events; there is no exportable authentication audit trail.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
A device password must be created during initialisation; complexity is length-based and not enforced on all interfaces.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Reolink embedded Linux firmware (Companion App: Reolink app / Reolink Client)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD card up to 512 GB, FTP/NAS, Reolink NVR or Home Hub (AES-128)
|
| Power, Battery & Charging
|
Battery: • Power: 5 V DC USB adapter • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Dual-band 2.4/5 GHz Wi-Fi, Ethernet (via NVR), RTSP/ONVIF
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: The E1 Pro is a well-featured indoor camera whose main weakness is the P2P/cloud path: a fixed key and insufficient transport protection, plus a firmware family with published command-injection and login-bypass issues. At-rest protection only appears when recordings go to a Reolink Home Hub, so the default microSD deployment leaves footage in the clear. Positives are an active update channel and a mature app ecosystem. Scope note: rated for default cloud/P2P operation with microSD recording; a Home Hub or NVR deployment with local-only access would raise the storage and communications criteria.
