CVE-2025-56799

Executive Summary

CVE-2025-56799 describes a command injection vulnerability in the Reolink desktop application version 8.18.12. The flaw resides in the scheduled cache-clearing mechanism, which improperly sanitizes folder names. A local attacker with the ability to create or rename folders on the system can inject arbitrary operating system commands. The vulnerability is disputed by the vendor, who argues that a crafted folder name would require the local user to attack themselves. However, from a DevSecOps perspective, this represents a privilege escalation or lateral movement vector if an attacker gains limited local access. The CVSS score is 0.0 in the NVD, but we assess a local vector with low complexity and low privileges.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary desktop application. Supply chain risk is limited to the distribution of the Reolink installer itself.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local file system access.
• Attack Complexity (AC): Low (L) – No special conditions required beyond creating a folder.
• Privileges Required (PR): Low (L) – The attacker needs user-level access to create folders.
• User Interaction (UI): None (N) – The scheduled task runs automatically.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Commands can modify files.
• Availability (A): Low (L) – Could disrupt the cache-clearing process.

Threat Level: Medium (Local exploitation, low privileges required, but disputed by vendor).

Deep Dive & Mechanics

The Reolink desktop application includes a scheduled task that clears cached data. This task likely iterates over directories and deletes files. The vulnerability arises because the application constructs a command string using the folder name without proper sanitization. For example, if the cache-clearing script uses a command like rm -rf /path/to/cache/[folder_name], an attacker can create a folder named ; malicious_command ; to inject arbitrary commands.

The vendor’s dispute hinges on the assumption that only the local user can create folders. However, in multi-user environments or after initial compromise, this can be used for privilege escalation or persistence.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import os
import subprocess

def clear_cache(folder_name):
    command = f"rm -rf /cache/{folder_name}"
    subprocess.run(command, shell=True)

Patched Code (Conceptual):

import os
import shutil

def clear_cache(folder_name):
    safe_path = os.path.join("/cache", folder_name)
    # Validate path is within expected directory
    if not safe_path.startswith("/cache/"):
        raise ValueError("Invalid path")
    shutil.rmtree(safe_path)

The patched version avoids shell execution and uses safe file operations with path validation.

Exploitation & Lab Setup

Red Team

Prerequisites: Local user access to a Windows or macOS system running Reolink 8.18.12.

Exploitation Steps:

1. Identify the cache directory (e.g., %APPDATA%\Reolink\cache on Windows).
2. Create a folder with a malicious name: ; calc.exe ; (Windows) or ; /bin/bash -c 'malicious_command' ; (macOS/Linux).
3. Wait for the scheduled cache-clearing task to execute.
4. The injected command runs with the privileges of the Reolink application.

Proof-of-Concept (Windows):

mkdir "%APPDATA%\Reolink\cache\; calc.exe ;"

Proof-of-Concept (macOS/Linux):

mkdir -p "/Users/username/Library/Application Support/Reolink/cache/; /bin/bash -c 'echo pwned > /tmp/pwned.txt' ;"

Blue Team

Detection Steps:

1. Monitor for unusual folder names containing shell metacharacters (;, |, &, `).
2. Audit scheduled tasks for the Reolink cache-clearing mechanism.
3. Review process creation events for unexpected command-line arguments.

Hunting Query (Windows Event Logs):

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4688)]]
      and
      *[EventData[Data[@Name='CommandLine'] and (contains(Data, ';') or contains(Data, '|'))]]
    </Select>
  </Query>
</QueryList>

Indicators of Compromise (IOCs)

• File System: Folders with names containing ;, |, &, or backticks in the Reolink cache directory.
• Process: Unexpected child processes spawned by Reolink.exe or Reolink.app.
• Network: Outbound connections from the Reolink process to unknown IPs (if command downloads payload).
• Registry (Windows): Modified scheduled tasks for Reolink cache clearing.

Detection Engineering

YARA Rule

rule Reolink_CommandInjection_FolderName
{
    meta:
        description = "Detects suspicious folder names in Reolink cache directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56799"
    strings:
        $suspicious1 = /[;|&`]/
    condition:
        // Check for files in Reolink cache path with suspicious characters
        for any i in (0..filesize) : (
            filesize > 0 and
            #suspicious1 > 0
        )
}

Sigma Rule

title: Reolink Cache Folder Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of folders with shell metacharacters in Reolink cache directory
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56799
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Reolink\cache\'
        TargetFilename|contains:
            - ';'
            - '|'
            - '&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate folder names with special characters (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Reolink Command Injection - Suspicious Folder Name"; flow:to_server; content:"Reolink"; nocase; content:"cache"; nocase; content:";"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the scheduled cache-clearing task if not critical.
2. Short-term: Restrict write access to the Reolink cache directory to only trusted users.
3. Long-term: Apply a vendor patch when available. In the interim, use application whitelisting to prevent execution of untrusted commands.
4. Compensating Controls: Monitor for anomalous folder creation and process execution.

Valters IT
DevSecOps & Cyber Threat Intelligence