{"id":"CVE-2025-55621","aliases":["EUVD-2025-25608","GHSA-f5wm-mx85-p6x2"],"status":"disputed","title":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows...","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0026,"percentile":0.17934,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-639"],"published":"2025-08-22T00:00:00Z","modified":"2026-06-17T09:41:54Z","products":[{"vendor":"reolink","product":"reolink"}],"references":[{"url":"https://relieved-knuckle-264.notion.site/Reolink-Download-a-profile-due-to-IDOR-21a43700364280ef9fc1ffb9c484a03e?source=copy_link","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55621"},{"url":"https://github.com/advisories/GHSA-f5wm-mx85-p6x2"}],"sources":{"cve":[{"id":"CVE-2025-55621","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.","status":"disputed","published":"2025-08-22T00:00:00Z","modified":"2025-09-04T14:37:30.597Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-25608","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.","status":"published","published":"2025-08-22T00:00:00Z","modified":"2025-09-04T14:37:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:47.35544Z"}],"ghsa":[{"id":"GHSA-f5wm-mx85-p6x2","title":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows...","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL.","status":"published","published":"2025-08-22T18:31:24Z","modified":"2025-09-04T15:31:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-639"],"updated_at":"2026-11-02T15:03:28.945171Z"}],"nvd":[{"id":"CVE-2025-55621","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.","status":"disputed","published":"2025-08-22T17:15:33.023Z","modified":"2026-06-17T09:41:54.01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:11:25.261243Z"}]}}