CVE-2019-11001
Published: 08 April 2019
Summary
CVE-2019-11001 is a high-severity OS Command Injection (CWE-78) vulnerability in Reolink Rlc-410W Firmware. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
The vulnerability CVE-2019-11001 is an OS command injection issue (CWE-78) present in the TestEmail functionality of Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through firmware version 1.0.227. An authenticated administrator can supply shell metacharacters in the addr1 field to inject and execute arbitrary commands as root on the device.
An attacker with valid administrative credentials can exploit the flaw remotely over the network without user interaction. Successful exploitation grants full root-level control of the IP camera, enabling arbitrary command execution that impacts confidentiality, integrity, and availability, consistent with its CVSS 3.1 score of 7.2.
Public proof-of-concept code is available demonstrating the injection, and the vulnerability is listed in the CISA known exploited vulnerabilities catalog. A technical analysis from VDOO describes broader issues in the affected Reolink camera line.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-2715
Vulnerability details
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
- CWE(s)
- KEV Date Added
- 18 December 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the addr1 input field in TestEmail to reject shell metacharacters and block OS command injection.
Requires the TestEmail functionality and underlying processes to operate with minimal privileges rather than root, limiting impact of any successful injection.
Mandates prompt application of vendor patches that eliminate the command-injection flaw in the TestEmail handler for the listed firmware versions.