A vulnerability exists in Reolink Home Hub devices before firmware v3.3.0.456_26031911 that allows attackers on the same local network to brute‑force the netclient and factory service credentials, potentially intercepting traffic between the Hub and connected cameras and compromising camera credentials. This could lead to unauthorized access to camera streams and configuration, exposing sensitive video data and enabling remote control of the cameras. The weakness is due to improper comparison of unique identifiers, classified as CWE‑1391.

The affected vendor/product is Reolink Home Hub, specifically any unit running firmware versions earlier than v3.3.0.456_26031911. No other vendors or product variations are listed, and the CVE impacts only the NetClient and Factory services of that hub.

The CVSS score of 5.8 indicates moderate severity, and the EPSS score is not provided, but the vulnerability is not listed in the CISA KEV catalog. Attackers would need physical or network access to the same local network as the Hub, making the attack vector local. Because the brute‑force method can succeed over time, the risk for organizations with exposed Hubs is significant if default credentials are used, but mitigation through firmware updates or strong passwords can reduce exploitability.