CVE-2019-11001

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
VendorProductVersion
reolinkrlc-410w_firmware
𝑥
≤ 1.0.227
reolinkc1_pro_firmware
𝑥
≤ 1.0.227
reolinkc2_pro_firmware
𝑥
≤ 1.0.227
reolinkrlc-422w_firmware
𝑥
≤ 1.0.227
reolinkrlc-511w_firmware
𝑥
≤ 1.0.227
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py
https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/
https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py
https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/