CVE-2025-56801

MediumCVSS 5.1/10Last modified Nov 5, 2026

Description

The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/shinyColumn/CVE-2025-56801Exploit, Third Party Advisory
https://shinycolumn.notion.site/reolink-aes-ivExploit, Third Party Advisory

Timeline

Published: Oct 21, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-568025.1The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers CVE-2025-568038.4Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arb CVE-2025-568076.1A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaSc CVE-2025-56816.5Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This i CVE-2025-568147.8A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell CVE-2025-568157.1Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transf CVE-2025-568168.8Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitr CVE-2025-568199.8An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.CVE-2025-56824.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Manageme CVE-2025-56835.5When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3 CVE-2025-56846.4The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Script CVE-2025-56859.8A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.1. This affects the function formNatlimit of the file /gofo