CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2020-25169 – Reolink P2P Cameras
https://notcve.org/view.php?id=CVE-2020-25169
26 Jan 2021 — The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to access sensitive information, such as camera feeds. Los productos P2P de Reolink afectados no protegen suficientemente los datos transferidos entre el dispositivo local y los servidores de Reolink. Esto puede permitir a un atacante acceder a información confidencial, tales como imágenes de cámaras • https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2020-25173 – Reolink P2P Cameras
https://notcve.org/view.php?id=CVE-2020-25173
26 Jan 2021 — An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access Un atacante con acceso a la red local puede obtener una clave de criptografía fija que puede permitir un mayor compromiso de las cámaras P2P Reolink fuera del acceso a la red local • https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02 • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 9.0EPSS: 15%CPEs: 10EXPL: 2CVE-2019-11001 – Reolink Multiple IP Cameras OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-11001
08 Apr 2019 — On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field. En los dispositivos Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W y RLC-511W hasta la versión 1.0.227, un administrador autenticado puede usar la funcionalidad "TestEmail" para inyectar y ejecutar comandos del Sistema Operativo como root, como es demostrado por los meta... • https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •