← CVE Radar
CVE-2019-11001Reolink Multiple IP Cameras OS Command Injection Vulnerability
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
7.2 HIGHEPSS 37.54%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.2 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 9.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:S/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Jan 8, 2025
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Details
- CVE ID
- CVE-2019-11001
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Apr 8, 2019
- Last modified
- 2026-06-17 02:12 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
reolinkrlc-410w firmware1 version range
- through 1.0.227
reolinkc1 pro firmware1 version range
- through 1.0.227
reolinkc2 pro firmware1 version range
- through 1.0.227
reolinkrlc-422w firmware1 version range
- through 1.0.227
reolinkrlc-511w firmware1 version range
- through 1.0.227