CVE-2025-55619

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

EPSS

0.40%

Published

Aug 22, 2025

Modified

Aug 28, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-321

Affected Products (1)

reolink · reolinkvulnerable

References (6)

https://cwe.mitre.org/data/definitions/321.html

Product

https://cwe.mitre.org/data/definitions/329.html

Product

https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-25173

Not Applicable

https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0

ExploitThird Party Advisory

https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs