CVE-2025-66050
CriticalSummary
Vivotek IP7137 camera with firmware version 0200a does not require a password by default when logging in as administrator. Users are not informed of the need to set a password, allowing unauthorized access. The product is End-of-Life, so a fix is not expected.
Risk Assessment
An unauthorized attacker can gain full access to the camera, potentially leading to privacy breach, video surveillance, or manipulation of camera settings.
Recommendation
Set a strong administrator password immediately. Due to lack of support, consider replacing the camera with a newer model with up-to-date firmware.
Other vulnerabilities in Vivotek IP7137
See all- CVE-2025-66052High
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection via the parameter "system_ntpIt" used by the "/cgi-bin/admin/setparam.cgi" endpoint. Due to CVE-2025-66050, administrative access is not protected by default. The product has reached end-of-life, so no fix is expected.
- CVE-2025-66049High
Vivotek IP7137 camera with firmware version 0200a has an information disclosure vulnerability allowing live camera footage to be accessed via RTSP on port 8554 without authentication. The product has reached end-of-life, so no fix is expected.
Original NVD description (English source)
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.