https://pwn.watch/t/reolink Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 18 Dec 2024 00:00:00 GMT https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001 https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001 Wed, 18 Dec 2024 00:00:00 GMT high <p>Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the &quot;TestEmail&quot; functionality to inject and run OS commands as root. Added to the CISA KEV catalog on 2024-12-18. CVE-2019-11001 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> See vendor advisory; CISA notes some models may be end-of-life</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-18: CISA added CVE-2019-11001 to the KEV catalog (federal deadline 2025-01-08) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2019-11001</p> https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407 https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407 Wed, 18 Dec 2024 00:00:00 GMT critical <p>Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. Added to the CISA KEV catalog on 2024-12-18. CVE-2021-40407 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> See vendor advisory; CISA notes some models may be end-of-life</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-18: CISA added CVE-2021-40407 to the KEV catalog (federal deadline 2025-01-08) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2021-40407</p>