A vulnerability in the Reolink Smart 2K+ Video Doorbell login function allows unauthenticated attackers to enumerate valid user accounts, posing a risk to user privacy and credential security.

This is an information disclosure vulnerability where the login function provides different error messages for invalid usernames versus incorrect passwords. This discrepancy allows an unauthenticated attacker to verify the existence of specific user accounts on the device.

The ability to enumerate valid accounts significantly lowers the bar for subsequent credential stuffing or brute force attacks against the device. With a CVSS score of 7.3, this flaw is categorized as high severity because it facilitates reconnaissance, which can lead to unauthorized access to video feeds and device settings, potentially resulting in privacy breaches or physical security compromises.

Immediate Action: Consult the Reolink official support portal to determine if a firmware update addressing this enumeration flaw has been released for your specific hardware revision.

Proactive Monitoring: Review device access logs for high volumes of login attempts originating from unknown or suspicious IP addresses that may indicate enumeration activity.

Compensating Controls: Ensure that the device is not directly exposed to the public internet by placing it behind a secure firewall or utilizing a VPN for remote access.

Public Exploit Available: No (exploit_available: false)

Given the potential for this vulnerability to be weaponized in automated credential attacks, administrators should prioritize identifying the affected firmware version on all deployed units. If a vendor patch is unavailable, restrict network access to the device immediately to prevent remote attackers from performing the enumeration process.