CVE-2025-66049
HighSummary
Vivotek IP7137 camera with firmware version 0200a has an information disclosure vulnerability allowing live camera footage to be accessed via RTSP on port 8554 without authentication. The product has reached end-of-life, so no fix is expected.
Risk Assessment
Unauthorized users with network access can view the camera feed, compromising privacy and security.
Recommendation
Restrict network access to the RTSP port, apply network-level authentication, and consider replacing the device with a newer one.
Other vulnerabilities in Vivotek IP7137
See all- CVE-2025-66052High
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection via the parameter "system_ntpIt" used by the "/cgi-bin/admin/setparam.cgi" endpoint. Due to CVE-2025-66050, administrative access is not protected by default. The product has reached end-of-life, so no fix is expected.
- CVE-2025-66050Critical
Vivotek IP7137 camera with firmware version 0200a does not require a password by default when logging in as administrator. Users are not informed of the need to set a password, allowing unauthorized access. The product is End-of-Life, so a fix is not expected.
Original NVD description (English source)
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.