High severity · published Apr 8, 2019
CVE-2019-11001
Reolink Multiple IP Cameras OS Command Injection Vulnerability
In wildKEV
7.2
CVSS
37.5%
EPSS
Yes
On KEV
Description
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)37.5% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 18, 2024
Federal remediation dueJan 8, 2025
Ransomware campaign useNot known
Affected products
Which versions
CP
C1 Pro Firmware · Reolink
through 1.0.227 · source: NVD
CP
C2 Pro Firmware · Reolink
through 1.0.227 · source: NVD
RF
Rlc-410w Firmware · Reolink
through 1.0.227 · source: NVD
RF
Rlc-422w Firmware · Reolink
through 1.0.227 · source: NVD
RF
Rlc-511w Firmware · Reolink
through 1.0.227 · source: NVD
MI
Multiple IP Cameras · Reolink
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11001
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/
x_refsource_MISC
https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py