CVE-2025-56800
Reolink
- Published
- 21 October 2025
- Last modified
- 17 June 2026
- CVSS
- 5.1 v3.1
- Severity
- medium
- EPSS
- 0.2% (15th pct)
- CISA KEV
- Not listed
- NVD status
- Analyzed
- Weaknesses
- CWE-290
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 0.2% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| Reolink | Reolink | unknown | 4.54.0.4.20250526, 8.18.12 |
References
- https://github.com/shinyColumn/CVE-2025-56800 exploit
- https://shinycolumn.notion.site/reolink-auth-bypass exploit
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.