Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NReolink
APPReolink8.18.12
Related vulnerabilities
Reolink: zakodowany na stałe klucz szyfrowania umożliwia odczyt tokenów
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configura...
Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing...
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in it...
An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication ...