Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system() function.
References
| Link | Resource |
|---|---|
| https://cwe.mitre.org/data/definitions/78.html | Technical Description |
| https://relieved-knuckle-264.notion.site/Reolink-camera-command-injection-Ddns-username-23f437003642800f83aef6b07f914212?pvs=74 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Oct 2025, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Reolink smart 2k\+ Plug-in Wi-fi Video Doorbell With Chime Firmware
Reolink smart 2k\+ Plug-in Wi-fi Video Doorbell With Chime Reolink |
|
| References | () https://cwe.mitre.org/data/definitions/78.html - Technical Description | |
| References | () https://relieved-knuckle-264.notion.site/Reolink-camera-command-injection-Ddns-username-23f437003642800f83aef6b07f914212?pvs=74 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:o:reolink:smart_2k\+_plug-in_wi-fi_video_doorbell_with_chime_firmware:3.0.0.4662_2503122283:*:*:*:*:*:*:* cpe:2.3:h:reolink:smart_2k\+_plug-in_wi-fi_video_doorbell_with_chime:-:*:*:*:*:*:*:* |
|
| Summary |
|
22 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-77 |
22 Aug 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-22 17:15
Updated : 2025-10-21 13:55
NVD link : CVE-2025-55637
Mitre link : CVE-2025-55637
CVE.ORG link : CVE-2025-55637
JSON object : View
Products Affected
reolink
- smart_2k\+_plug-in_wi-fi_video_doorbell_with_chime_firmware
- smart_2k\+_plug-in_wi-fi_video_doorbell_with_chime
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')