CVE-2019-11001
Published 2019-04-08 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2019-11001 is a high-severity (CVSS 7.2) vulnerability in Reolink Multiple IP Cameras. CISA added it to the Known Exploited Vulnerabilities catalog on December 18, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 8, 2025. CISA does not currently list it as used in ransomware campaigns. Reolink has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 2 known-exploited Reolink vulnerabilities →Description
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Reolink — Multiple IP Cameras
Name: Reolink Multiple IP Cameras OS Command Injection Vulnerability
Date added: 2024-12-18 · Due: 2025-01-08
Required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
References
- https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py
- https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/
- https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py
- https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11001