CVE-2025-66049
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vivotek | ip7137 | From 0200a (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Vivotek IP7137 camera firmware version 0200a, allowing unauthenticated access to the live video stream via the RTSP protocol on port 8554. This means that anyone with network access to the camera can view the live feed without needing to provide any authentication, potentially exposing private video footage. The issue may affect all firmware versions, and no fix is expected since the product is at its End-Of-Life stage. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized users viewing live camera footage, compromising user privacy and security. This exposure of live video streams can result in sensitive information being leaked, surveillance being bypassed, and potential misuse of the camera feed by malicious actors. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by scanning your network for devices with port 8554 open and attempting to access the RTSP stream without authentication. For example, use the command: `nmap -p 8554 --open <target-ip>` to identify devices with the RTSP port open. Then, try to access the stream using an RTSP client like VLC with the URL `rtsp://<target-ip>:8554/` to see if the live feed is accessible without credentials. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no patches are expected due to the product being End-Of-Life, immediate mitigation steps include restricting network access to the camera by placing it behind a firewall or VLAN to limit who can reach port 8554, disabling RTSP if possible, changing default passwords if applicable, and monitoring network traffic for unauthorized access attempts. [1]