CVE-2025-66050
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vivotek | ip7137 | From 0200a (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1393 | The product uses default passwords for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Vivotek IP7137 camera with firmware version 0200a does not require a password by default when logging in as an administrator. Users are not informed that setting a password is necessary, which means anyone can access the administrator account without authentication. This lack of authentication allows unauthorized users to control the camera and access sensitive functions.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to the camera's administrator functions, allowing attackers to control the device, view live video streams, and potentially compromise privacy and security. Since no password is required by default, anyone on the network can exploit this to spy on or manipulate the camera without permission. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the Vivotek IP7137 camera allows unauthenticated access to its live video stream via the RTSP protocol on port 8554. For example, you can use the command: `ffplay rtsp://<camera-ip>:8554/` or `vlc rtsp://<camera-ip>:8554/` to see if the live feed is accessible without authentication. Additionally, scanning your network for devices with open port 8554 using tools like `nmap -p 8554 <camera-ip>` can help identify vulnerable cameras. [1]
What immediate steps should I take to mitigate this vulnerability?
Since the vendor has not provided a fix and the product is End-Of-Life, immediate mitigation steps include restricting network access to the camera by placing it behind a firewall or VLAN to limit exposure, disabling RTSP streaming if possible, changing default passwords if the option exists, and monitoring network traffic for unauthorized access attempts. Consider replacing the device with a supported model that receives security updates. [1]