Command Injection Vulnerability in Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W Devices

CVE-2019-11001 · HIGH Severity

AV:N/AC:L/AU:S/C:C/I:C/A:C

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.

Learn more about our Web Application Penetration Testing UK.