PT-2025-42925 · Reolink · Reolink Desktop Application

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-56800

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Reolink desktop application version 8.18.12

Description The Reolink desktop application has a flaw in its local authentication. The application’s lock screen password logic is implemented on the client side using JavaScript within an Electron resource file. The password is stored and returned via a modifiable JavaScript property, a.settingsManager.lockScreenPassword. An attacker can modify this property to bypass authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-56800

Affected Products

Reolink Desktop Application

References · 6

• 🔥 https://shinycolumn.notion.site/reolink-auth-bypass · Exploit
• 🔥 https://github.com/shinyColumn/CVE-2025-56800 · Exploit
• https://osv.dev/vulnerability/CVE-2025-56800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56800 · Security Note
• https://twitter.com/CVEnew/status/1980714062095782103 · Twitter Post
• https://twitter.com/BugBountyShorts/status/1980721468783624347 · Twitter Post