CVE-2025-55621: Reolink

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.

Affected products

• Reolink Reolink: version 4.54.0.4.20250526 only

Published 2025-08-22. Last modified 2026-06-17.