CVE-2019-11001

HIGH KEV

Reolink RLC-410W/C1/C2/RLC-422W/RLC-511W <1.0.227 Authenticated OS Command Injection

Title source: llm

Exploitation Summary

CVE-2019-11001 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 18, 2024.

Description

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.

References (3)

Core 3

Core References

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11001

Broken Link, Exploit, Third Party Advisory x_refsource_misc

https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/

Exploit, Third Party Advisory x_refsource_misc

https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py

View Exploit ZIP pw:eip

Scores

CVSS v3 7.2

EPSS 0.2943

EPSS Percentile 96.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2024-12-18

VulnCheck KEV 2024-12-18

InTheWild.io 2024-12-18

ENISA EUVD EUVD-2019-2715

CWE

CWE-78

Status published

Products (5)

reolink/c1_pro_firmware < 1.0.227

reolink/c2_pro_firmware < 1.0.227

reolink/rlc-410w_firmware < 1.0.227

reolink/rlc-422w_firmware < 1.0.227

reolink/rlc-511w_firmware < 1.0.227

Published Apr 08, 2019

KEV Added Dec 18, 2024

Tracked Since Feb 18, 2026