CVEvulnerability

CVE-2019-11001

7.2 HIGH Known exploited Published 2019-04-08 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Reolink Multiple IP Cameras OS Command Injection Vulnerability — Reolink Multiple IP Cameras

Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.

Added to KEV: 2024-12-18
Remediation due: 2025-01-08
Ransomware use: Unknown
Required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Notes: https://reolink.com/product-eol/ ; https://reolink.com/download-center/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-11001

Status: Analyzed
Published: 2019-04-08
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses: CWE-78

Description

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.

Affected configurations

• reolink rlc-410w firmware (<= 1.0.227) • reolink c1 pro firmware (<= 1.0.227) • reolink c2 pro firmware (<= 1.0.227) • reolink rlc-422w firmware (<= 1.0.227) • reolink rlc-511w firmware (<= 1.0.227)

Weakness · CWE (1)

CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References