CVE-2025-56799

MEDIUM

Reolink - Command Injection

Title source: rule

Description

Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself.

Exploits (1)

github WORKING POC 2 stars

by adminlove520 · pythonpoc

https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-56799

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory] https://github.com/shinyColumn/CVE-2025-56799

View Exploit ZIP pw:eip

[Exploit, Third Party Advisory] https://shinycolumn.notion.site/reolink-command-injection

Scores

CVSS v3 6.5

EPSS 0.0251

EPSS Percentile 85.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE

CWE-77

Status published

Products (1)

reolink/reolink 8.18.12

Published Oct 21, 2025

Tracked Since Feb 18, 2026