Live › vulnerability › CVE-2019-11001
Go to dashboardSeveral Reolink IP camera models contain an OS command injection flaw in the TestEmail function. An authenticated admin can run arbitrary OS commands as root on the camera.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Reolink Multiple IP Cameras | vendor | – | – |
| reolink rlc-410w firmware | vendor | <= 1.0.227 | – |
| reolink c1 pro firmware | vendor | <= 1.0.227 | – |
| reolink c2 pro firmware | vendor | <= 1.0.227 | – |
| reolink rlc-422w firmware | vendor | <= 1.0.227 | – |
| reolink rlc-511w firmware | vendor | <= 1.0.227 | – |
Identify Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, or RLC-511W cameras on the network and check their firmware version against the vendor's advisory; exact version details are unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2019-11001")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.