Command Injection Vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell
CVE-2025-55637

6.5MEDIUM

Key Information:

Vendor

Reolink

Status
Smart 2K+ Plug-in Wi-Fi Video Doorbell
Vendor
CVE Published:
22 August 2025

What is CVE-2025-55637?

The Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell contains a command injection vulnerability that occurs through the setddns_pip_system() function. This vulnerability allows attackers to execute arbitrary commands, potentially compromising the device and exposing user data. Proper validation and sanitization of input parameters are necessary to mitigate this security risk. Users should ensure their firmware is updated to the latest version to protect against potential exploits.

References

https://cwe.mitre.org/data/definitions/78.html
https://relieved-knuckle-264.notion.site/Reolink-camera-c...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.