Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-56800: Reolink Desktop App 8.18.12 Allows Password Bypass

CVE-2025-56800 · published 1 year ago

Summary

If an attacker has access to the user's computer, they can potentially bypass the lock screen password in Reolink's desktop application. This means the app's security is compromised, allowing unauthorized access to the user's account. Users should be cautious when allowing other users to access their computer and ensure they keep their password secure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
reolink	reolink	8.18.12 `cpe:2.3:a:reolink:reolink:8.18.12::::desktop:::`

Original advisory text

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application.

References

https://github.com/shinyColumn/CVE-2025-56800 Exploit Third Party Advisory
https://shinycolumn.notion.site/reolink-auth-bypass Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-290Authentication Bypass by Spoofing

Timeline

Published21 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-56800 · NVD

Track software like this

Free during beta