CVE-2025-66052
HighSummary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection via the parameter "system_ntpIt" used by the "/cgi-bin/admin/setparam.cgi" endpoint. Due to CVE-2025-66050, administrative access is not protected by default. The product has reached end-of-life, so no fix is expected.
Risk Assessment
An attacker with administrative privileges can execute arbitrary commands on the camera, potentially leading to full compromise of the device.
Recommendation
Restrict access to the camera, change default passwords, and consider replacing the device with a newer, supported one.
Other vulnerabilities in Vivotek IP7137
See all- CVE-2025-66049High
Vivotek IP7137 camera with firmware version 0200a has an information disclosure vulnerability allowing live camera footage to be accessed via RTSP on port 8554 without authentication. The product has reached end-of-life, so no fix is expected.
- CVE-2025-66050Critical
Vivotek IP7137 camera with firmware version 0200a does not require a password by default when logging in as administrator. Users are not informed of the need to set a password, allowing unauthorized access. The product is End-of-Life, so a fix is not expected.
Original NVD description (English source)
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default, The vendor has not replied to the CNA Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.