CVE-2025-56799

Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

1.22% chance of exploitation in the next 30 days, 67th percentile

Published

2025-10-21

Updated

2025-10-22

Proof-of-concept exploits (1)

• shinyColumn/CVE-2025-56799

References

• CVE Record
• NVD entry

Related

• CVE-2025-46408
• CVE-2025-50944
• CVE-2025-56800
• CVE-2025-56801
• CVE-2025-56802
• CVE-2025-56803