CVE-2019-11001: Reolink Multiple IP Cameras OS Command Injection Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 2,081 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 37.5%
EPSS score, percentile 98.5 of all scored records
- How severe?
- 7.2 High
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline . The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Full text
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://reolink.com/product-eol/
- https://reolink.com/download-center/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11001
Affected products and versions
The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2019-11001 to its Known Exploited Vulnerabilities (KEV) catalog on 18 Dec 2024.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 8 Jan 2025.
- The CVE record was published on 8 Apr 2019, 2,081 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.2 (High), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 37.5% (percentile 98.5), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
References
More exploited Reolink vulnerabilities
- CVE-2021-40407: Reolink RLC-410W IP Camera OS Command Injection Vulnerability