CVE-2019-11001 is an OS command injection vulnerability in the 'TestEmail' diagnostic feature shipped on several Reolink IP camera models: an attacker who already holds an authenticated admin session on the camera can inject shell metacharacters into the email-address field to run arbitrary commands as root, fully compromising the device. NVD has published its own Primary CVSS v3.1 score of 7.2 (high), CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2024-12-18, and FIRST's EPSS model puts the probability of exploitation in the 98th percentile.
Vulnerability summary
7.2
High
37.5%
EPSS score (FIRST)
Yes
CISA KEV catalog
2019-04-08
Published
Vulnerability ID: CVE-2019-11001 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W and RLC-511W IP camera firmware ('TestEmail' diagnostic function) | — | Firmware through 1.0.227; CISA's KEV catalog entry notes the affected product line may be end-of-life/end-of-service and does not record a vendor-supplied fixed version |
What does this mean for affected devices?
CVE-2019-11001 (CWE-78, OS Command Injection) affects the 'TestEmail' diagnostic functionality built into several Reolink IP camera models. NVD's description states: "On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the 'TestEmail' functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field" (NVD).
CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2024-12-18 under the name "Reolink Multiple IP Cameras OS Command Injection Vulnerability." CISA's required action for defenders is blunt: "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable," with a compliance due date of 2025-01-08 (CISA KEV catalog, catalog version 2026.11.06).
NVD has published its own Primary CVSS v3.1 score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, source [email protected], matching the Secondary score independently assigned by the CVE Numbering Authority. The PR:H component means exploitation requires an already-authenticated administrator session, but because the 'TestEmail' field accepts injected shell metacharacters, that administrative access translates directly into root-level command execution on the camera's embedded Linux firmware (NVD).
FIRST's EPSS model scores the probability of exploitation at 0.37542 (98.5th percentile) as of 2026-11-07 — markedly higher than most of the other advisories in this corpus, consistent with its active-exploitation status in the KEV catalog and the public proof-of-concept exploit code referenced in NVD's records (FIRST EPSS).
Because CISA's own guidance treats affected Reolink models as potentially end-of-life, operators should check with Reolink for a current firmware update before relying on this device, and in the meantime should isolate it from untrusted networks and avoid granting camera admin credentials to any account that is not strictly necessary.
Evidence
- On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the 'TestEmail' functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field. — NVD
- Added to the CISA KEV catalog on 2024-12-18 as 'Reolink Multiple IP Cameras OS Command Injection Vulnerability'; required action states the product could be end-of-life/end-of-service and users should discontinue use if no mitigation is available; action due date 2025-01-08. — CISA KEV catalog
- NVD's own Primary CVSS v3.1 score is 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. — NVD
- EPSS score is 0.37542 (98.5th percentile) as of 2026-11-07, reflecting active known exploitation. — FIRST EPSS
Questions about this page?
