CVE-2019-11001

Known Exploited (CISA KEV)HIGH

7.2

CVSS Severity Score

EPSS Score28.9590%

EPSS Percentile86.73th

Published2019年4月8日

Last Modified2025年11月6日

Vulnerability Description

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.

Affected Platforms (CPE)

💻

Reolink

Rlc 410w Firmware

<= 1.0.227

💻

Reolink

C1 Pro Firmware

<= 1.0.227

💻

Reolink

C2 Pro Firmware

<= 1.0.227

💻

Reolink

Rlc 422w Firmware

<= 1.0.227

💻

Reolink

Rlc 511w Firmware

<= 1.0.227

References & Advisories

🔗 https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py

🔗 https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/

🔗 https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py

🔗 https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11001

Vulnerability Description

Affected Platforms (CPE)

Rlc 410w Firmware

C1 Pro Firmware

C2 Pro Firmware

Rlc 422w Firmware

Rlc 511w Firmware

References & Advisories

相關漏洞威脅