CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection
An authenticated admin can inject OS commands via the TestEmail feature to execute arbitrary code as root on Reolink cameras.
- Exploited in the wild
- Since 18 Dec 2024
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11001?
CVE-2019-11001 is a high-severity command injection vulnerability in Reolink Rlc-410w Firmware, published on 8 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
Weakness: CWE-78
Which versions are affected by CVE-2019-11001?
It affects 5 products.
Products include Reolink C1 Pro Firmware, Reolink C2 Pro Firmware, Reolink Rlc-410w Firmware, Reolink Rlc-422w Firmware, Reolink Rlc-511w Firmware.
How do I fix CVE-2019-11001?
No fix has been published for CVE-2019-11001 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 8 Jan 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-11001 being exploited?
Yes. Attackers have exploited CVE-2019-11001 in the wild since at least 18 Dec 2024.
Sources
Also known as GHSA-73c7-5g37-cmq7.