Dashboard / CVE-2025-56802

CVE-2025-56802

MEDIUM 1 PoC
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2025-10-21 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: Low

Description

The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
reolink reolink 8.18.12

References & Advisories (2)

https://github.com/shinyColumn/CVE-2025-56802
Exploit Third Party Advisory

Proof of Concept (1)

—
https://github.com/shinyColumn/CVE-2025-56802
nomi-sec

Bug Bounty Relevance

55 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

5.1 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — Exploitation Probability

0.13%
Raw Score 0.001330
Percentile 2.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00133
2026-11-13
0.00133
2026-11-12
0.00133
2026-11-10
0.00133
2026-11-09
0.00133
2026-11-08
0.00133
2026-11-07
0.00133
2026-11-06
0.00133
2026-11-05
0.00133

Intelligence Sources

nvd ref →

External Links