CVE-2019-11001

criticalknown exploitedcovered by 1 sourcefirst seen 2024-12-18

Actively exploited. CVE-2019-11001 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-12-18) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.

Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.

CSIRTS triage

vendor: Reolink Remote code execution

What: Reolink IP cameras contain an authenticated OS command injection vulnerability allowing an authenticated admin to inject and run OS commands as root.
Who is affected: Authenticated admin users of Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras.
Urgency: Remediation is urgent due to active exploitation and critical severity.
Action: Apply the latest firmware updates from Reolink.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2019-11001

Get an email if CVE-2019-11001 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.

Advisory coverage (1)

criticalexploitedCVE-2019-11001: Reolink Multiple IP Cameras OS Command Injection Vulnerabilitycisa-kev · 2024-12-18

External references

NVD record for CVE-2019-11001

CVE.org record

CISA KEV catalog

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2019-11001 status](https://www.csirts.com/badge/CVE-2019-11001)](https://www.csirts.com/cve/CVE-2019-11001)