Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system() function. More information : https://cwe.mitre.org/data/definitions/78.html
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 allows unauthorized attackers to cause a Denial of Service (DoS) via initiating a...
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 was discovered to manage users’ sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service (DoS) via...
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to...
Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users’ passwords via manipulation of the userName value. More information : https://relieved-knuckle-264.notion.site/Account-Takeover-Change-password-23c437003642806bb821fec983aedb9f?source=copy_link
Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 allows authenticated attackers to create accounts with elevated privileges. More information : https://relieved-knuckle-264.notion.site/Account-Takeover-Create-Account-23c43700364280c2b0bddba94a9362ed
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime – firmware v3.0.0.4662_2503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage. More...
An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior that supports...
An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components. More information : https://relieved-knuckle-264.notion.site/Reolink-Intent-Redirection-21a43700364280cabb8bcce817ab1879?pvs=143
An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge). More information : https://relieved-knuckle-264.notion.site/Reolink-App-lock-screen-Bypass-21a437003642804f869fde8535d18a3f?source=copy_link
Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience. More...
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users’ profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it...
A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. More information : https://relieved-knuckle-264.notion.site/Reolink-javascript-injection-qr-code-21a43700364280eaa76fd56a01b25410
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering....