CVE-2025-9983
BaseFortify
Publication date: 2025-09-22
Last updated on: 2025-09-22
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| galayou | g2_camera | 11.100001.01.28 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9983 is a vulnerability in GALAYOU G2 cameras where the video streams, delivered via RTSP, are supposed to be protected by randomly generated credentials. However, these credentials are not actually required to access the streams, meaning anyone can view the video without authentication. Changing the credentials does not restrict access. This is classified as missing authentication for a critical function. [1]
How can this vulnerability impact me? :
This vulnerability allows unauthorized users to access live video streams from the affected cameras without any authentication. This can lead to privacy breaches, unauthorized surveillance, and exposure of sensitive video data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by scanning your network for GALAYOU G2 cameras streaming video via RTSP without requiring authentication. For example, use tools like 'nmap' with the RTSP script to identify open RTSP ports and test access without credentials. A sample command: nmap -p 554 --script rtsp-url-brute <target-ip>. Additionally, you can try accessing the RTSP stream URL directly (e.g., rtsp://<camera-ip>/) without credentials to verify if the stream is accessible. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include isolating the affected GALAYOU G2 cameras from untrusted networks to prevent unauthorized access, disabling RTSP streaming if possible, or placing the cameras behind a firewall or VPN to restrict access. Since changing credentials does not affect access, network-level controls are necessary until a vendor patch or update is available. [1]