Security readout for executives and security teams
Plain-English summary
This vulnerability lets an authenticated administrator on specific Reolink cameras run operating-system commands as root through the TestEmail feature. It is high impact because successful abuse can fully compromise the camera. The admin-privilege requirement limits opportunistic access, but CISA KEV inclusion means exploitation has been observed.
Executive priority
Prioritize remediation for exposed or business-critical cameras this cycle. KEV status moves this beyond theoretical risk, but the need for admin privileges makes exposure management and credential hygiene central to urgency.
Technical view
CVE-2019-11001 is CWE-78 command injection in Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227. The described injection point is the TestEmail functionality. CVSS 3.1 is 7.2: network reachable, low complexity, high privileges required, no user interaction, complete CIA impact.
Likely exposure
Exposure is likely limited to organizations running the named Reolink camera models at firmware 1.0.227 or earlier. Risk rises when administrative interfaces are reachable from broad internal networks, the internet, or shared credentials are used.
Exploitation context
CISA KEV lists CVE-2019-11001 as known exploited. The source bundle also cites a public proof-of-concept repository. The provided evidence does not identify affected deployment scale, currently targeted sectors, or a specific fixed firmware version.
Researcher notes
Evidence supports authenticated command injection as root via TestEmail in listed Reolink devices. Avoid assuming unauthenticated exploitability. The affected CPE data in the bundle is incomplete, so validation should rely on model and firmware inventory rather than automated CPE matching alone.
Mitigation direction
- Inventory the named Reolink models and record firmware versions.
- Check Reolink guidance for fixed firmware or replacement direction.
- Restrict camera administration to trusted management networks only.
- Remove direct internet exposure for camera admin interfaces.
- Rotate camera admin credentials after remediation if compromise is suspected.
Validation and detection
- Identify any listed models running firmware 1.0.227 or earlier.
- Confirm administrative interfaces are not exposed to untrusted networks.
- Review camera and network logs for unexpected admin activity.
- Verify vendor firmware status against official Reolink guidance.
- Document compensating controls where firmware updates are unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-11001 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/CVE reference · x_refsource_MISC
- https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.pyCVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11001CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.