CVE-2025-56799
📋 TL;DR
The Reolink desktop application version 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism. An attacker could execute arbitrary commands by crafting a malicious folder name, potentially leading to remote code execution. This primarily affects users running the vulnerable desktop application on their local systems.
💻 Affected Systems
- Reolink Desktop Application
📦 What is this software?
Reolink by Reolink
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could execute arbitrary commands with the privileges of the Reolink application user, potentially leading to full system compromise, data theft, or malware installation.
Likely Case
Limited impact since exploitation requires local access and a crafted folder name, making it more relevant for targeted attacks against specific users rather than widespread exploitation.
If Mitigated
With proper user privilege separation and application sandboxing, impact would be limited to the application's context without system-wide compromise.
🎯 Exploit Status
Exploitation requires local access and creation of a specially crafted folder name. Public proof-of-concept exists in the provided GitHub reference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.18.13 or later
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Open Reolink desktop application. 2. Navigate to Settings > About. 3. Check for updates and install the latest version (8.18.13+). 4. Restart the application after update.
🔧 Temporary Workarounds
Disable scheduled cache clearing
allPrevent the vulnerable feature from executing by disabling automatic cache cleaning
Restrict folder creation permissions
allLimit ability to create folders in directories accessible to Reolink application
🧯 If You Can't Patch
- Run Reolink application with minimal user privileges (not as administrator/root)
- Monitor for unusual process creation from Reolink application using endpoint detection tools
🔍 How to Verify
Check if Vulnerable:
Check Reolink application version in Settings > About. If version is exactly 8.18.12, the system is vulnerable.Check Version:
Check application version in GUI: Settings > AboutVerify Fix Applied:
After updating, verify version is 8.18.13 or higher in Settings > About.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution from Reolink process
- Creation of unexpected folders or files by Reolink application
Network Indicators:
- Outbound connections from Reolink to unexpected destinations
SIEM Query:
Process creation where parent_process contains 'reolink' and command_line contains suspicious patterns like 'cmd', 'powershell', 'bash'