CVE-2019-11001
Reolink Multiple IP Cameras OS Command Injection Vulnerability
Description
CVE-2019-11001 is a high-severity OS command injection vulnerability affecting multiple Reolink IP camera models including the RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W through firmware version 1.0.227. An authenticated administrator can exploit the TestEmail functionality to inject and execute arbitrary OS commands as root by inserting shell metacharacters into the addr1 email address field. With a CVSS v3.1 base score of 7.2 and an EPSS score of 33.82% at the 96.9th percentile, this vulnerability is widely targeted across IoT environments. CISA has added CVE-2019-11001 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 8, 2025, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| reolink | rlc-410w firmware | <= 1.0.227 |
| reolink | c1 pro firmware | <= 1.0.227 |
| reolink | c2 pro firmware | <= 1.0.227 |
| reolink | rlc-422w firmware | <= 1.0.227 |
| reolink | rlc-511w firmware | <= 1.0.227 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py(Exploit, Third Party Advisory)
- https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11001(US Government Resource)
Weakness Type
OS Command Injection via Email Configuration
CVE-2019-11001 is an OS command injection vulnerability that manifests in the email testing functionality of multiple Reolink IP cameras. When an authenticated administrator uses the TestEmail feature to verify email notification settings, the addr1 field (the recipient email address) is incorporated into an operating system command without proper sanitization. By injecting shell metacharacters into this field, an attacker can break out of the intended command context and execute arbitrary commands with root privileges on the camera's underlying Linux operating system. This represents a critical failure in input validation where user-supplied data crosses a trust boundary from the web application layer to the operating system command layer. Learn more about OS command injection at CWE-78.
Impact Analysis
The impact of CVE-2019-11001 is rated High across all three CIA dimensions, with the additional severity factor of root-level command execution. Confidentiality is critically compromised because root access on the camera grants unrestricted access to all stored video recordings, configuration files, Wi-Fi credentials stored on the device, and any network traffic the camera can observe. Multiple camera models are affected, potentially exposing surveillance footage from numerous locations within an organization.
Integrity faces maximum impact as root-level command execution allows the attacker to modify firmware, alter camera configurations, manipulate or delete recorded footage, install persistent backdoors, and fully repurpose the device. A compromised camera can be silently reconfigured to stream video to attacker-controlled servers while appearing to function normally to administrators.
Availability is also rated High because root access enables the attacker to brick the device, disable recording capabilities, or use the camera's resources for malicious purposes such as cryptocurrency mining or DDoS attacks. The attack vector is network-based (AV:N) with low complexity (AC:L), though it requires high-level privileges (PR:H) in the form of administrator access. The EPSS score of 33.82% at the 96.9th percentile confirms that this is among the most actively exploited IoT vulnerabilities. The scope of impact is amplified by the number of affected models: five different Reolink camera models share the same vulnerable code, significantly increasing the total exposed device population.
Exploit Maturity
CVE-2019-11001 has very high exploit maturity with publicly available proof-of-concept exploit code. A Python-based exploit script is publicly available on GitHub, providing a ready-to-use tool that automates the command injection through the TestEmail functionality. This dramatically lowers the skill threshold required for exploitation.
CISA has confirmed active exploitation by including the vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 8, 2025. The EPSS score of 33.82% at the 96.9th percentile indicates widespread targeting. The combination of a public exploit script, multiple affected camera models, and the prevalence of default credentials on IoT devices creates an especially dangerous situation. Botnet operators routinely scan for vulnerable IP cameras and incorporate them into large-scale attack networks. While CISA lists the ransomware association as unknown, compromised IoT devices serve as persistent footholds that are difficult to detect and can facilitate broader network intrusions. The fact that the exploit achieves root-level access makes these compromised cameras particularly valuable to attackers.
Remediation
-
Update firmware on all affected Reolink cameras immediately. Check the Reolink support website for firmware versions newer than 1.0.227 for the RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W models. Apply updates through the Reolink client application or camera web interface, prioritizing internet-accessible devices.
-
Change all default and weak administrator credentials. Replace factory-default passwords with strong, unique credentials on every affected camera. The vulnerability requires administrative authentication, so strong passwords are a critical compensating control. Use a password manager to maintain unique credentials per device.
-
Segment IoT devices onto isolated network zones. Place all IP cameras on a dedicated VLAN with strict firewall rules that allow only necessary traffic flows. Block outbound internet access from cameras except for required services like NTP and firmware update servers. This limits the blast radius of a compromised device.
-
Disable internet-facing access to camera management interfaces. Remove port forwarding rules, disable UPnP, and disable cloud P2P connectivity features if not strictly required. Use VPN access for remote camera administration rather than exposing management interfaces directly to the internet.
-
Audit all Reolink cameras for signs of compromise. Review camera configurations for unauthorized changes, check for unexpected outbound connections, and verify firmware integrity. Given the availability of root-level exploits, consider performing a factory reset and fresh firmware installation on any camera that may have been exposed while running vulnerable firmware.
Technical Details
CVE-2019-11001 is an OS command injection vulnerability affecting multiple Reolink IP camera models. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack with low complexity, high privilege requirement, no user interaction needed, and maximum impact across confidentiality, integrity, and availability.
The vulnerability exists in the TestEmail functionality of the camera's web management interface. When an administrator tests email notification settings, the application constructs an operating system command that includes the addr1 parameter (the recipient email address). The application fails to sanitize shell metacharacters in this parameter, allowing command injection. An attacker with administrative access sends a specially crafted email test request where the addr1 field contains shell metacharacters followed by arbitrary commands.
For example, injecting a semicolon followed by a command into the addr1 field causes the camera to first attempt the email operation and then execute the injected command. The commands execute as root because the web server process on these embedded Linux devices runs with root privileges, a common configuration in IoT firmware. This grants the attacker unrestricted access to the entire device.
Affected models and firmware versions include the Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W through firmware version 1.0.227. All five models share the same vulnerable code in their web management interface, indicating a common codebase across the product line. The vulnerability was responsibly disclosed and a proof-of-concept exploit demonstrating the injection technique is publicly available.
Frequently Asked Questions
What is CVE-2019-11001?
CVE-2019-11001 is an OS command injection vulnerability in multiple Reolink IP camera models. An authenticated administrator can inject and execute arbitrary operating system commands as root through the TestEmail functionality by placing shell metacharacters in the email address field.
Which Reolink camera models are affected?
Five Reolink models are affected: the RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W. All devices running firmware version 1.0.227 or earlier are vulnerable.
Is there a public exploit available for CVE-2019-11001?
Yes. A Python-based proof-of-concept exploit script is publicly available on GitHub that automates the command injection attack through the TestEmail functionality. This makes the vulnerability accessible to attackers with minimal technical skill.
Can this vulnerability be exploited remotely without authentication?
The vulnerability requires administrator-level authentication (CVSS PR:H). However, many IP cameras retain default credentials or use weak passwords, effectively allowing remote exploitation by any attacker who can guess or brute-force the admin password.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.