CVE-2025-55619

Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.

• CWE-321

• https://cwe.mitre.org/data/definitions/321.htmlProduct
• https://cwe.mitre.org/data/definitions/329.htmlProduct
• https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferencesThird Party Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25173Not Applicable
• https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0Exploit, Third Party Advisory
• https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0Exploit, Third Party Advisory

Published

Aug 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55605Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow i…7.5
• CVE-2025-55606Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow i…7.5
• CVE-2025-5561A vulnerability was found in PHPGurukul Curfew e-Pass Manage…9.8
• CVE-2025-55611D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in …7.5
• CVE-2025-55613Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow i…9.8
• CVE-2025-55618In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an a…7.3
• CVE-2025-5562A vulnerability was found in PHPGurukul Curfew e-Pass Manage…9.8
• CVE-2025-55620A cross-site scripting (XSS) vulnerability in the valuateJav…6.1
• CVE-2025-55621An Insecure Direct Object Reference (IDOR) vulnerability in …6.5
• CVE-2025-55622Reolink v4.54.0.4.20250526 was discovered to contain a task …6.5
• CVE-2025-55623An issue in the lock screen component of Reolink v4.54.0.4.2…5.4
• CVE-2025-55624An intent redirection vulnerability in Reolink v4.54.0.4.202…5.3