PT-2025-34452 · Reolink · Reolink

Published 2025-08-22 · Updated 2025-10-02 · CVE-2025-55621

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Reolink version 4.54.0.4.20250526

Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in Reolink. This allows unauthorized attackers to access and download other users' profile photos via a crafted URL.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2025-55621

Affected Products

Reolink

References · 9

• 🔥 https://relieved-knuckle-264.notion.site/Reolink-Download-a-profile-due-to-IDOR-21a43700364280ef9fc1ffb9c484a03e?source=copy_link · Exploit
• https://osv.dev/vulnerability/CVE-2025-55621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55621 · Security Note
• https://t.me/cveNotify/137139 · Telegram Post
• https://t.me/cveNotify/134263 · Telegram Post
• https://t.me/CVEtracker/30691 · Telegram Post
• https://t.me/cveNotify/133812 · Telegram Post
• https://twitter.com/CVEnew/status/1958964686650843405 · Twitter Post
• https://t.me/cveNotify/134043 · Telegram Post