CVE Feed

    Dashboard / CVE / CVE-2025-56802

    CVE-2025-56802

    The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application.

    Published:Oct 21, 2025
    Last Modified:Nov 17, 2025
    EPS:Oct 21, 2025
    EPSS Score:0.0001
    CVSS Score:5.1

    Affected Products

    Vendor
    Reolink
    Product
    Reolink

    Exploits

    https://github.com/shinyColumn/CVE-2025-56802https://shinycolumn.notion.site/reolink-aes-keyhttps://github.com/shinyColumn/CVE-2025-56802

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-56799 (CVSS 6.5) — Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing…
    CVE-2025-56800 (CVSS 5.1) — Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The applic…
    CVE-2025-56801 (CVSS 5.1) — The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in it…
    CVE-2025-60856 (CVSS 6.8) — Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console.…
    CVE-2025-55619 (CVSS 9.8) — Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An …
    CVE-2025-55620 (CVSS 6.1) — A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 a…
    CVE-2025-55623 (CVSS 5.4) — An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication …
    CVE-2025-55624 (CVSS 5.3) — An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access inte…
    CVE-2025-55625 (CVSS 6.3) — An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious…
    CVE-2025-55622 (CVSS 6.5) — Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskA…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High