CVE-2025-60855

Reolink Video Doorbell WiFi DB_566128M5MP_W performs insufficient validation of firmware update signatures. This allows attackers to load malicious firmware images, resulting in arbitrary code execution with root privileges. NOTE: this is disputed by the Supplier because the integrity of updates is instead assured via a "private encryption algorithm" and other "tamper-proof verification."

• CWE-77

• https://cybermaya.in/posts/Post-45/
• https://reolink.com/download-center/

Published

Oct 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60835An issue in the unrar.dll component of IZArc v4.6 allows att…7.8
• CVE-2025-60837A reflected cross-site scripting (XSS) vulnerability in MCMS…6.1
• CVE-2025-60838An arbitrary file upload vulnerability in MCMS v6.0.1 allows…6.5
• CVE-2025-6085The Make Connector plugin for WordPress is vulnerable to arb…7.2
• CVE-2025-60852A CSV Injection vulnerability existed in Instant Developer F…6.5
• CVE-2025-60854A vulnerability has been found in D-Link R15 (AX1500) 1.20.0…9.8
• CVE-2025-60856Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shel…6.8
• CVE-2025-60858Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and tran…7.5
• CVE-2025-60859Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 …6.1
• CVE-2025-6086The CSV Me plugin for WordPress is vulnerable to arbitrary f…7.2
• CVE-2025-60865Insecure Permissions vulnerability in avanquest Driver Updat…7.8
• CVE-2025-60868The Alt Redirect 1.6.3 addon for Statamic fails to consisten…6.5