VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 22, 2025· Updated Jun 17, 2026

CVE-2025-55621

CVE-2025-55621

Description

An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.

Affected products

3
  • Reolink/Reolinkllm-fuzzy3 versions
    = 4.54.0.4.20250526+ 2 more
    • (no CPE)range: = 4.54.0.4.20250526
    • cpe:2.3:a:reolink:reolink:4.54.0.4.20250526:*:*:*:*:android:*:*
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.