Filtered by vendor Reolink Subscriptions
Total 107 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-55625 1 Reolink 1 Reolink 2025-08-28 6.5 Medium
An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL.
CVE-2025-55619 2 Google, Reolink 2 Android, Reolink 2025-08-28 9.8 Critical
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
CVE-2025-55620 1 Reolink 1 Reolink 2025-08-28 6.1 Medium
A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2025-55622 1 Reolink 1 Reolink 2025-08-28 6.5 Medium
Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings.
CVE-2025-55621 1 Reolink 1 Reolink 2025-08-28 6.5 Medium
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL.
CVE-2025-55623 2 Google, Reolink 2 Android, Reolink 2025-08-28 5.4 Medium
An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge).
CVE-2025-55624 1 Reolink 1 Reolink 2025-08-28 5.3 Medium
An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components.
CVE-2025-55627 1 Reolink 1 Smart 2k+ Video Doorbel 2025-08-23 5.3 Medium
Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows authenticated attackers to create accounts with elevated privileges.
CVE-2025-55631 1 Reolink 1 Smart 2k+ Video Doorbell 2025-08-23 7.5 High
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to manage users' sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service (DoS) via resource exhaustion.
CVE-2025-55634 1 Reolink 1 Smart 2k+ Video Doorbel 2025-08-23 7.5 High
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to cause a Denial of Service (DoS) via initiating a large number of simultaneous ffmpeg-based stream pushes.
CVE-2025-55630 1 Reolink 1 Smart 2k+ Video Doorbel 2025-08-23 7.3 High
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to enumerate existing accounts.
CVE-2025-55637 1 Reolink 1 Smart 2k+ Video Doorbell 2025-08-23 6.5 Medium
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system() function.
CVE-2025-55626 1 Reolink 1 Smart 2k+ Video Doorbell 2025-08-23 5.3 Medium
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage.
CVE-2025-55629 1 Reolink 1 Smart 2k+ Video Doorbell 2025-08-23 6.5 Medium
Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users' passwords via manipulation of the userName value.
CVE-2019-11001 1 Reolink 10 C1 Pro, C1 Pro Firmware, C2 Pro and 7 more 2025-07-30 7.2 High
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
CVE-2021-40407 1 Reolink 2 Rlc-410w, Rlc-410w Firmware 2025-07-30 7.2 High
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-21236 1 Reolink 2 Rlc-410w, Rlc-410w Firmware 2025-04-15 7.5 High
An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2021-40423 1 Reolink 2 Rlc-410w, Rlc-410w Firmware 2025-04-15 7.5 High
A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-21796 1 Reolink 2 Rlc-410w, Rlc-410w Firmware 2025-04-15 8.2 High
A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-21801 1 Reolink 2 Rlc-410w, Rlc-410w Firmware 2025-04-15 7.5 High
A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can send a malicious packet to trigger this vulnerability.