Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55558 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:00:09.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151523 - https://github.com/pytorch/pytorch/pull/151887 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55559 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-29T16:11:01.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/issues/84205 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55560 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T19:39:24.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151522 - https://github.com/pytorch/pytorch/pull/151897 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55564 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T17:49:51.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tendaac15v10brv15030519multitd01.com - https://github.com/clxhzg/CVE/blob/main/Tenda/AC15/SetIpMacBind.md
CVE ID: CVE-2025-55573 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T14:56:26.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/QuantumNous/new-api - https://github.com/zh0u9527/docs/blob/master/new-api-wp.md
CVE ID: CVE-2025-55574 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T16:03:37.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/docmost/docmost
CVE ID: CVE-2025-55575 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T13:33:26.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=service_detail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Aether-0/CVE-2025-55575
CVE ID: CVE-2025-55579 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-09-02T17:53:49.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ddobrev25/CVE-2025-55579 - https://solidinvoice.co/
CVE ID: CVE-2025-55580 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-09-02T17:53:14.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ddobrev25/CVE-2025-55580 - https://solidinvoice.co/
CVE ID: CVE-2025-55581 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T18:36:28.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the `dcp` and `signalc` binaries without validating their integrity, origin, or permissions. An attacker with filesystem access (e.g., via UART or firmware modification) may replace these binaries to achieve persistent arbitrary code execution with root privileges. The issue stems from improper handling of executable trust and absence of integrity che
execution with root privileges. The issue stems from improper handling of executable trust and absence of integrity checks in the watchdog logic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://legacy.us.dlink.com/pages/product.aspx?id=f9c0458bfe7b4ff3bf7fad1cf6fcc9a1 - https://cybermaya.in/posts/Post-42/
CVE ID: CVE-2025-55582 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-29T13:50:44.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `signalc` without verifying integrity, authenticity, or permissions. An attacker with local filesystem access (via physical access, firmware modification, or debug interfaces) can replace these binaries with malicious payloads. The script executes these binaries as root in an infinite loop, leading to persistent privilege escalation and arbitrary code execution. This
ese binaries as root in an infinite loop, leading to persistent privilege escalation and arbitrary code execution. This issue is mitigated in v1.09.02, but the product is officially End-of-Life and unsupported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10431 - https://cybermaya.in/posts/Post-43/
CVE ID: CVE-2025-55583 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T15:00:23.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bullet
HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397 - https://cybermaya.in/posts/Post-44/
CVE ID: CVE-2025-55584 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:16:15.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Telnet/PoC.md
CVE ID: CVE-2025-55585 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:14:15.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Eval%20Injection/PoC.md
CVE ID: CVE-2025-55586 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:11:59.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20BOF/formFilter%20PoC.md
CVE ID: CVE-2025-55587 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:10:39.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20BOF/formMapDelDevice%20PoC.md
CVE ID: CVE-2025-55588 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:09:12.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20BOF/formPortFw%20PoC.md
CVE ID: CVE-2025-55589 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:07:56.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters at /boafrm/formMapDelDevice. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%201.md
CVE ID: CVE-2025-55590 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:00:20.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%203.md
CVE ID: CVE-2025-55591 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T19:59:07.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%202.md
CVE ID: CVE-2025-55599 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:09:04.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formWlanSetup function via the parameter f_wds_wepKey. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_65/65.md
CVE ID: CVE-2025-55602 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:43.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formSysCmd function via the submit-url parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_79/79.md
CVE ID: CVE-2025-55603 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:24.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_45/45.md
CVE ID: CVE-2025-55605 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:37.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the saveParentControlInfo function via the deviceName parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_46/46.md
CVE ID: CVE-2025-55606 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:18.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromAdvSetMacMtuWan function via the serverName parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_44/44.md
CVE ID: CVE-2025-55611 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:30.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formLanguageChange function via the nextPage parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_80/80.md
CVE ID: CVE-2025-55613 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T17:43:15.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_58/58.md
CVE ID: CVE-2025-55618 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T20:27:40.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://hyundai.com - https://github.com/MatJosephs/CVEs/tree/main/CVE-2025-55618
CVE ID: CVE-2025-55619 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:44.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/329.html - https://cwe.mitre.org/data/definitions/321.html - https://nvd.nist.gov/vuln/detail/CVE-2020-25173 - https://developer.android.com/reference/kotlin/androidx/security/
ml - https://nvd.nist.gov/vuln/detail/CVE-2020-25173 - https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences - https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0
CVE ID: CVE-2025-55620 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T17:46:57.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Reolink-javascript-injection-qr-code-21a43700364280eaa76fd56a01b25410
CVE ID: CVE-2025-55621 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-09-04T14:37:30.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Reolink-Download-a-profile-due-to-IDOR-21a43700364280ef9fc1ffb9c484a03e?so
s: - https://relieved-knuckle-264.notion.site/Reolink-Download-a-profile-due-to-IDOR-21a43700364280ef9fc1ffb9c484a03e?source=copy_link
CVE ID: CVE-2025-55622 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-09-01T21:12:54.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Reolink-Task-Hijacking-21a437003642808ba21fd79530a21e96
CVE ID: CVE-2025-55623 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T17:55:24.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Reolink-App-lock-screen-Bypass-21a437003642804f869fde8535d18a3f?source=copy_link
CVE ID: CVE-2025-55624 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T19:58:53.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Reolink-Intent-Redirection-21a43700364280cabb8bcce817ab1879?pvs=143
CVE ID: CVE-2025-55625 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-09-11T15:20:15.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior that supports redirection to Alexa URLs, which are not guaranteed to remain at the same domain indefinitely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/601.html - https://relieved-knuckle-264.notion.site/Reolink-Deeplink-Redirect-21b437003642804a865af2fb02
ata/definitions/601.html - https://relieved-knuckle-264.notion.site/Reolink-Deeplink-Redirect-21b437003642804a865af2fb02942f66
CVE ID: CVE-2025-55626 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T20:01:35.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Access-the-Administrator-Settings-page-with-IDOR-23c43700364280c3a8fccc2bbdcda78c?source=copy_link
CVE ID: CVE-2025-55627 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T18:04:38.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows authenticated attackers to create accounts with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Account-Takeover-Create-Account-23c43700364280c2b0bddba94a9362ed
CVE ID: CVE-2025-55629 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T18:02:30.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users' passwords via manipulation of the userName value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Account-Takeover-Change-password-23c437003642806bb821fec983aedb9f?source=copy_link
CVE ID: CVE-2025-55630 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T18:01:17.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to enumerate existing accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/User-Enumeration-Vulnerability-23c43700364280b6a46ae6302818b77e?source=copy_link
CVE ID: CVE-2025-55631 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-09-11T15:18:35.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to manage users' sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service (DoS) via resource exhaustion. NOTE: the Supplier reports that the system-wide limit is intentional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://relieved-knuckle-264.notion.site/Token-max-Dos-23c437003642804db673cbd5449fcc67?source=copy_link
CVE ID: CVE-2025-55634 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T17:58:04.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to cause a Denial of Service (DoS) via initiating a large number of simultaneous ffmpeg-based stream pushes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/400.html - https://cwe.mitre.org/data/definitions/306.html - https://relieved-knuckle-264.notion.site/RTMP-Injection-DoS-through-Unauth
s://cwe.mitre.org/data/definitions/306.html - https://relieved-knuckle-264.notion.site/RTMP-Injection-DoS-through-Unauthenticated-Stream-Publish-23c437003642800297c8c128b6117885?pvs=74