BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-11-17

Assigner: MITRE

Description

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-21

Last Modified

2025-11-17

Generated

2026-07-06

AI Q&A

2025-10-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-56800

Affected Vendors & Products

Vendor	Product	Version / Range
reolink	reolink	8.18.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the Reolink desktop application version 8.18.12, where the local authentication mechanism is implemented entirely on the client side using JavaScript. The lock screen password is stored and returned via a modifiable JavaScript property (a.settingsManager.lockScreenPassword). An attacker can patch this property to bypass the authentication, effectively allowing unauthorized access.

Impact Analysis

This vulnerability can allow an attacker to bypass the lock screen authentication on the Reolink desktop application, potentially granting unauthorized access to the application and any sensitive data or controls it manages.

Mitigation Strategies

Since the vulnerability is due to the client-side implementation of the lock screen password in the Reolink desktop application, immediate mitigation steps include avoiding use of the vulnerable version 8.18.12, restricting access to the application to trusted users only, and monitoring for updates or patches from Reolink that address this issue. Additionally, consider using alternative authentication methods or applications until a fix is available.

Hi! I’m here to help you understand CVE-2025-56800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70