CVE-2025-55619CRITICAL 9.8EPSS p29.4%

CVE-2025-55619CVE-2025-55619

Description

Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.38% probability of exploitation · percentile 29.4% · 2026-06-18T12:00:27Z
Published2025-08-22
Last modified2025-08-28

Underlying weaknesses· 1

CWE-321

References

  1. https://cwe.mitre.org/data/definitions/321.html
  2. https://cwe.mitre.org/data/definitions/329.html
  3. https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences
  4. https://nvd.nist.gov/vuln/detail/CVE-2020-25173
  5. https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0
  6. https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0

1

TypeTargetConfidenceTier
WeaknessUse of Hard-coded Cryptographic Keycwe-3210%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-56577
CVE
Reolink RLC-410W IP Camera OS Command Injection Vulnerability
CVE
CVE-2025-54754
CVE
CVE-2025-55637
CVE
CVE-2025-52665
CVE
CVE-2025-54807
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.