High · published April 8, 2019
CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 98.5th percentile for exploit probability.
🚨 An authenticated admin can inadvertently turn their surveillance camera into a hacker's playground! Just by using the "TestEmail" function, they can execute OS commands as root on several Reolink devices. 😱 Think of it like a hotel concierge who mistakenly gives a guest a master key, allowing them to snoop around the hotel’s admin areas. Instead of just sending emails, the admin can now open the floodgates to the entire system! An attacker could potentially gain complete control over the device, accessing sensitive data or even manipulating the camera feeds. This would not only compromise the integrity of security systems but could also lead to a devastating breach of privacy. 🏴☠️
Think of it like a hotel concierge who mistakenly gives a guest a master key, allowing them to snoop around the hotel’s admin areas. Instead of just sending emails, the admin can now open the floodgates to the entire system! This vulnerability allows an authenticated admin to inject shell metacharacters in the "addr1" field while using the "TestEmail" functionality, thereby executing arbitrary OS commands as root on the affected Reolink camera devices.
An attacker could potentially gain complete control over the device, accessing sensitive data or even manipulating the camera feeds. This would not only compromise the integrity of security systems but could also lead to a devastating breach of privacy. 🏴☠️ To protect against this vulnerability, update affected devices to the latest firmware version (post 1.0.227). Additionally, review administrative access policies to ensure only trusted individuals can manage device settings. 🛡️ You’ve got this! Stay proactive and secure your cameras today! 🔒😊