CVE-2025-55619
Severity CVSS v4.0:
Pending analysis
Type:
CWE-321
Use of Hard-coded Cryptographic Key
Publication date:
22/08/2025
Last modified:
28/08/2025
Description
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:reolink:reolink:4.54.0.4.20250526:*:*:*:*:android:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://cwe.mitre.org/data/definitions/321.html
- https://cwe.mitre.org/data/definitions/329.html
- https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences
- https://nvd.nist.gov/vuln/detail/CVE-2020-25173
- https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0
- https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0