Description
An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior that supports redirection to Alexa URLs, which are not guaranteed to remain at the same domain indefinitely.
References (2)
Core 2
Core References
Third Party Advisory
https://cwe.mitre.org/data/definitions/601.html
Exploit, Third Party Advisory
https://relieved-knuckle-264.notion.site/Reolink-Deeplink-Redirect-21b437003642804a865af2fb02942f66
Scores
CVSS v3
6.3
EPSS
0.0022
EPSS Percentile
11.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-601
Status
published
Products (1)
reolink/reolink
4.54.0.4.20250526
Published
Aug 22, 2025
Tracked Since
Feb 18, 2026