CVE-2025-55619

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-55619
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cwe.mitre.org/data/definitions/321.html Product
https://cwe.mitre.org/data/definitions/329.html Product
https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-25173 Not Applicable
https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 Exploit Third Party Advisory
https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:reolink:reolink:4.54.0.4.20250526:*:*:*:*:android:*:*
History

28 Aug 2025, 13:34

Type Values Removed Values Added
First Time Reolink reolink
Reolink
CPE cpe:2.3:a:reolink:reolink:4.54.0.4.20250526:*:*:*:*:android:*:*
References () https://cwe.mitre.org/data/definitions/321.html - () https://cwe.mitre.org/data/definitions/321.html - Product
References () https://cwe.mitre.org/data/definitions/329.html - () https://cwe.mitre.org/data/definitions/329.html - Product
References () https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences - () https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences - Third Party Advisory
References () https://nvd.nist.gov/vuln/detail/CVE-2020-25173 - () https://nvd.nist.gov/vuln/detail/CVE-2020-25173 - Not Applicable
References () https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 - () https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 - Exploit, Third Party Advisory
References () https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 - () https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 - Exploit, Third Party Advisory

26 Aug 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) Se descubrió que Reolink v4.54.0.4.20250526 contenía una clave de cifrado y un vector de inicialización codificados. Un atacante podría aprovechar esta vulnerabilidad para descifrar los tokens de acceso y de sesión web almacenados en la aplicación mediante ingeniería inversa.
CWE CWE-321
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References
  • () https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0 -

22 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 17:15

Updated : 2025-08-28 13:34

NVD link : CVE-2025-55619

Mitre link : CVE-2025-55619

CVE.ORG link : CVE-2025-55619

JSON object : View

Products Affected

reolink

  • reolink
CWE
CWE-321

Use of Hard-coded Cryptographic Key