Reolink vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Reolink flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability Exploited since Dec 18, 2024 · CVSS 7.2
• CVE-2019-11001 Reolink Multiple IP Cameras OS Command InjectionExploited since Dec 18, 2024 · CVSS 7.2

Latest high and critical flaws

• CVE-2025-55637 Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the Critical 9.8 · Aug 22, 2025
• CVE-2025-55634 Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unautHigh 7.5 · Aug 22, 2025
• CVE-2025-55630 A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283High 7.3 · Aug 22, 2025
• CVE-2025-55619 Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector.Critical 9.8 · Aug 22, 2025
• CVE-2021-40150 The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path.High 7.5 · Jul 17, 2022
• CVE-2021-44394 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44375 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44366 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44357 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44356 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44355 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44354 Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.High 7.5 · Apr 14, 2022
• CVE-2021-44419 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44418 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44417 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44416 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44415 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44414 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44413 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44412 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44411 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44410 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44409 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44408 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022
• CVE-2021-44407 A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.High 7.7 · Jan 28, 2022