deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-38663
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject invalid file types when reading inodes

To prevent inodes with invalid file types from tripping through the vfs
and causing malfunctions or assertion failures, add a missing sanity check
when reading an inode from a block device.  If the file type is not valid,
treat it as a filesystem error.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1a5c204e175a78556b8ef1f7683249fa5197295a; https://git.kernel.org/stable/c/2cf0c4130bf340be3935d097a3dcbfefdcf65815; https://git.kernel.org/stable/c/42cd46b3a8b1497b9258dc7ac445dbd6beb73e2f
CVE: CVE-2025-38664
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

Add check for the return value of devm_kmemdup()
to prevent potential null pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0fde7dccbf4c8a6d7940ecaf4c3d80a12f405dd7; https://git.kernel.org/stable/c/1c30093d58cd3d02d8358e2b1f4a06a0aae0bf5b; https://git.kernel.org/stable/c/3028f2a4e746b499043bbb8ab816f975473a0535
CVE: CVE-2025-38665
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode

Andrei Lalaev reported a NULL pointer deref when a CAN device is
restarted from Bus Off and the driver does not implement the struct
can_priv::do_set_mode callback.

There are 2 code path that call struct can_priv::do_set_mode:
- directly by a manual restart from the user space, via
  can_changelink()
- delayed automatic restart after bus off (deactivated by default)

To prevent the NULL pointer deference, refuse a manual restart or
configure the automatic restart delay in can_changelink() and report
the error via extack to user space.

As an additional safety measure let can_restart() return an error if
can_priv::do_set_mode is not set instead of dereferencing it
unchecked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5; https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae; https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599
CVE: CVE-2025-38667
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: fix potential out-of-bound write

The buffer is set to 20 characters. If a caller write more characters,
count is truncated to the max available space in "simple_write_to_buffer".
To protect from OoB access, check that the input size fit into buffer and
add a zero terminator after copy to the end of the copied data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/16285a0931869baa618b1f5d304e1e9d090470a8; https://git.kernel.org/stable/c/81a635b6eccd6fc889f6d07ab9583b705f739ce1
CVE: CVE-2025-38668
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: core: fix NULL dereference on unbind due to stale coupling data

Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can
lead to NULL pointer dereference when regulators are accessed post-unbind.

This can happen during runtime PM or other regulator operations that rely
on coupling metadata.

For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers
a panic in regulator_lock_recursive() due to stale coupling state.

Ensure n_coupled is set to 0 to prevent access to invalid pointers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/233d3c54c9620e[PII_REDACTED]9ea1d0b0f5d748ca; https://git.kernel.org/stable/c/5d4261dbb3335221fd9c6e69f909ba79ee6663a7; https://git.kernel.org/stable/c/6c49eac796681e250e34156bafb643930310bd4a
CVE: CVE-2025-38669
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/gem-shmem: Use dma_buf from GEM object instance"

This reverts commit 1a148af06000e545e714fe3210af3d77ff903c11.

The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.

Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.

Hence, this revert to going back to using .import_attach->dmabuf.

v3:
- cc stable
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/291a77604858a8b47cf6640a12b76e97f99e00ed; https://git.kernel.org/stable/c/6d496e9569983a0d7a05be6661126d0702cf94f7
CVE: CVE-2025-38670
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()

`cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change
to different stacks along with the Shadow Call Stack if it is enabled.
Those two stack changes cannot be done atomically and both functions
can be interrupted by SErrors or Debug Exceptions which, though unlikely,
is very much broken : if interrupted, we can end up with mismatched stacks
and Shadow Call Stack leading to clobbered stacks.

In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task,
but x18 stills points to the old task's SCS. When the interrupt handler
tries to save the task's SCS pointer, it will save the old task
SCS pointer (x18) into the new task struct (pointed to by SP_EL0),
clobbering it.

In `call_on_irq_stack()`, it can happen when switching from the task stack
to the IRQ stack and when switching back. In both cases, we can be
interrupted when the SCS pointer points to the IRQ SCS, but SP points to
the task stack. The nested interrupt handler pushes its return addresses
on the IRQ SCS. It then detects that SP points to the task stack,
calls `call_on_irq_stack()` and clobbers the task SCS pointer with
the IRQ SCS pointer, which it will also use !

This leads to tasks returning to addresses on the wrong SCS,
or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK
or FPAC if enabled.

This is possible on a default config, but unlikely.
However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and
instead the GIC is responsible for filtering what interrupts the CPU
should receive based on priority.
Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU
even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very*
frequently depending on the system configuration and workload, leading
to unpredictable kernel panics.

Completely mask DAIF in `cpu_switch_to()` and restore it when returning.
Do the same in `call_on_irq_stack()`, but restore and mask around
the branch.
Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency
of behaviour between all configurations.

Introduce and use an assembly macro for saving and masking DAIF,
as the existing one saves but only masks IF.
CVSS Score: 7.1 (HIGH)
CWE: CWE-668
References: https://git.kernel.org/stable/c/0f67015d72627bad72da3c2084352e0aa134416b; https://git.kernel.org/stable/c/407047893a64399f2d2390ff35cc6061107d805d; https://git.kernel.org/stable/c/708fd522b86d2a9544c34ec6a86fa3fc23336525
CVE: CVE-2025-38671
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: qup: jump out of the loop in case of timeout

Original logic only sets the return value but doesn't jump out of the
loop if the bus is kept active by a client. This is not expected. A
malicious or buggy i2c client can hang the kernel in this case and
should be avoided. This is observed during a long time test with a
PCA953x GPIO extender.

Fix it by changing the logic to not only sets the return value, but also
jumps out of the loop and return to the caller with -ETIMEDOUT.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0d33913fce67a93c1eb83396c3c9d6b411dcab33; https://git.kernel.org/stable/c/42c4471b30fa203249f476dd42321cd7efb7f6a8; https://git.kernel.org/stable/c/89459f168b78e5c801dc8b7ad037b62898bc4f57
CVE: CVE-2025-38672
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/gem-dma: Use dma_buf from GEM object instance"

This reverts commit e8afa1557f4f963c9a511bd2c6074a941c308685.

The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.

Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.

Hence, this revert to going back to using .import_attach->dmabuf.

v3:
- cc stable
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1918e79be908b8a2c[PII_REDACTED]bc196c14d928a; https://git.kernel.org/stable/c/e7bdb3104a2f71ec1439d37f8e6e2f201dbcd7cf
CVE: CVE-2025-38673
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance"

This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065.

The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.

Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.

Hence, this revert to going back to using .import_attach->dmabuf.

v3:
- cc stable
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2712ca878b688682ac2ce02aefc413fc76019cd9; https://git.kernel.org/stable/c/e31f5a1c2cd38bf977736cdfa79444e19d4005ec
CVE: CVE-2025-38674
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/prime: Use dma_buf from GEM object instance"

This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8.

The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.

Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.

Hence, this revert to going back to using .import_attach->dmabuf.

v3:
- cc stable
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/5f05d83ce689a8930a70dfa73f879604aef8cc03; https://git.kernel.org/stable/c/fb4ef4a52b79a22ad382bfe77332642d02aef773
CVE: CVE-2025-38675
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

xfrm: state: initialize state_ptrs earlier in xfrm_state_find

In case of preemption, xfrm_state_look_at will find a different
pcpu_id and look up states for that other CPU. If we matched a state
for CPU2 in the state_cache while the lookup started on CPU1, we will
jump to "found", but the "best" state that we got will be ignored and
we will enter the "acquire" block. This block uses state_ptrs, which
isn't initialized at this point.

Let's initialize state_ptrs just after taking rcu_read_lock. This will
also prevent a possible misuse in the future, if someone adjusts this
function.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/463562f9591742be62ddde3b426a0533ed496955; https://git.kernel.org/stable/c/6bf2daafc51bcb9272c0fdff2afd38217337d0d3; https://git.kernel.org/stable/c/94d077c331730510d5611b438640a292097341f0
CVE: CVE-2025-43751
Published: 2025-08-22
Description: User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43751
CVE: CVE-2025-50674
Published: 2025-08-22
Description: An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-269
References: http://openmediavault.com; https://gist.github.com/xbz0n/4b98e9291ddd5bb5e6232609e36b2082; https://xbz0n.sh/blog/CVE-2025-50674
CVE: CVE-2025-50733
Published: 2025-08-22
Description: NextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute arbitrary JavaScript code when HTML content is rendered in the AI chat interface. The vulnerability occurs because user-influenced HTML from AI responses is rendered in an iframe with 'allow-scripts' sandbox permission without proper sanitization. This can be exploited through specifically crafted prompts that cause the AI to generate malicious HTML/JavaScript code. When a user views the HTML preview, the injected JavaScript executes in the user's browser context, potentially allowing attackers to exfiltrate sensitive information (including API keys stored in localStorage), perform actions on behalf of the user, and steal session data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fai1424/Vulnerability-Research/blob/main/CVE-2025-50733/README.md; https://hackmd.io/@fai1424/BkgqMnNxgl; https://github.com/fai1424/Vulnerability-Research/blob/main/CVE-2025-50733/README.md
CVE: CVE-2025-51605
Published: 2025-08-22
Description: An issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-Control-Allow-Origin without any whitelist validation, while also enabling Access-Control-Allow-Credentials: true. This allows any malicious origin to make authenticated cross-origin requests and read sensitive responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250512-02.md
CVE: CVE-2025-52094
Published: 2025-08-22
Description: Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy component
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://specterops.io/blog/2025/08/12/hklmsystemsetupsmartdeploy-the-static-keys-to-abusing-pdq-smartdeploy/; https://www.pdq.com/; https://www.pdq.com/products/smartdeploy/
CVE: CVE-2025-52095
Published: 2025-08-22
Description: An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://specterops.io/blog/2025/08/12/hklmsystemsetupsmartdeploy-the-static-keys-to-abusing-pdq-smartdeploy/; https://www.pdq.com/; https://www.pdq.com/products/smartdeploy/
CVE: CVE-2025-53363
Published: 2025-08-22
Description: dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.
CWE: CWE-22, CWE-73
References: https://github.com/donknap/dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q
CVE: CVE-2025-55599
Published: 2025-08-22
Description: D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formWlanSetup function via the parameter f_wds_wepKey.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_65/65.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_65/65.md
CVE: CVE-2025-55602
Published: 2025-08-22
Description: D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formSysCmd function via the submit-url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_79/79.md; https://www.dlink.com/en/security-bulletin/; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_79/79.md
CVE: CVE-2025-55603
Published: 2025-08-22
Description: Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_45/45.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_45/45.md
CVE: CVE-2025-55605
Published: 2025-08-22
Description: Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the saveParentControlInfo function via the deviceName parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_46/46.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_46/46.md
CVE: CVE-2025-55606
Published: 2025-08-22
Description: Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromAdvSetMacMtuWan function via the serverName parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_44/44.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_44/44.md
CVE: CVE-2025-55611
Published: 2025-08-22
Description: D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formLanguageChange function via the nextPage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_80/80.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_80/80.md
CVE: CVE-2025-55741
Published: 2025-08-22
Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-862
References: https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989; https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx; https://www.youtube.com/watch?v=J_WV8fCXlJM
CVE: CVE-2024-50644
Published: 2025-08-22
Description: zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gitee.com/fushuling/cve/blob/master/CVE-2024-50644.md; https://github.com/zhisheng17/blog; https://github.com/zhisheng17/blog/issues/64
CVE: CVE-2024-53494
Published: 2025-08-22
Description: Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gitee.com/fushuling/cve/blob/master/CVE-2024-53494.md; https://github.com/caozongpeng/SpringBootBlog/issues/23; https://github.com/caozongpeng/SpringBootBlog/issues/23
CVE: CVE-2025-55398
Published: 2025-08-22
Description: An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. In UPER (Unaligned Packed Encoding Rules), asn1c-generated decoders fail to enforce INTEGER constraints when the bound is positive and exceeds 32 bits in length, potentially allowing incorrect or malicious input to be processed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1284
References: https://github.com/mouse07410/asn1c/issues/222
CVE: CVE-2025-55619
Published: 2025-08-22
Description: Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://cwe.mitre.org/data/definitions/321.html; https://cwe.mitre.org/data/definitions/329.html; https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences
CVE: CVE-2025-55620
Published: 2025-08-22
Description: A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://relieved-knuckle-264.notion.site/Reolink-javascript-injection-qr-code-21a[PII_REDACTED]0eaa76fd56a01b25410
CVE: CVE-2025-55621
Published: 2025-08-22
Description: An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://relieved-knuckle-264.notion.site/Reolink-Download-a-profile-due-to-IDOR-21a[PII_REDACTED]0ef9fc1ffb9c484a03e?source=copy_link
CVE: CVE-2025-55622
Published: 2025-08-22
Description: Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-491
References: https://relieved-knuckle-264.notion.site/Reolink-Task-Hijacking-21a[PII_REDACTED]08ba21fd79530a21e96
CVE: CVE-2025-55623
Published: 2025-08-22
Description: An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-288
References: https://relieved-knuckle-264.notion.site/Reolink-App-lock-screen-Bypass-21a[PII_REDACTED]04f869fde8535d18a3f?source=copy_link
CVE: CVE-2025-55624
Published: 2025-08-22
Description: An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-601
References: https://relieved-knuckle-264.notion.site/Reolink-Intent-Redirection-21a[PII_REDACTED]0cabb8bcce817ab1879?pvs=143