Vivotek IP7137 cameras contain four critical vulnerabilities allowing unauthenticated…
Vivotek IP7137 cameras contain four critical vulnerabilities allowing unauthenticated access to live feeds, default admin credentials, path traversal, and command injection; no fix expected as product is EOL.
CERT Polska coordinated disclosure of four vulnerabilities affecting Vivotek IP7137 IP cameras. The most severe issue (CVE-2025-66049) allows unauthorized viewing of live camera footage via RTSP on port 8554 without authentication, directly compromising user privacy. Additionally, the camera ships with no default administrator password (CVE-2025-66050), leaving devices completely exposed unless users proactively configure authentication.
Authenticated attackers can exploit path traversal (CVE-2025-66051) to access files outside the webroot directory and perform command injection (CVE-2025-66052) via the unsanitized system_ntpIt parameter in the setparam.cgi endpoint. The command injection vulnerability is particularly dangerous when combined with the default passwordless admin access, effectively allowing unauthenticated remote code execution.
The vendor did not respond to disclosure attempts, and since the Vivotek IP7137 has reached End-Of-Life status, no patches are expected. All firmware versions are believed affected, with testing conducted on version 0200a. Organizations using these cameras should immediately isolate them from network access or replace them with supported alternatives.
Mentioned in this report
Detection guidance
Vivotek Camera setparam.cgi system_ntp Command Injection Attempt
Detects HTTP requests to the Vivotek setparam.cgi endpoint containing shell metacharacters in the system_ntp parameter, indicative of CVE-2025-66052 command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Vivotek Camera setparam.cgi system_ntp Command Injection Attempt
id: bc1277fc-28b4-57f5-b78d-3e7264869843
status: experimental
description: Detects HTTP requests to the Vivotek setparam.cgi endpoint where the
system_ntp parameter contains shell metacharacters or command separators, consistent
with unauthenticated remote code execution via CVE-2025-66052.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: setparam.cgi
injection:
cs-uri-query|contains:
- system_ntp=
metachars:
cs-uri-query|contains:
- ;
- '|'
- '`'
- $(
- '&&'
- '%0a'
- '%0d'
condition: selection and injection and metachars
falsepositives:
- Legitimate NTP configuration changes made through the camera admin UI that unusually
include punctuation in the value (rare)
level: high
Vivotek Camera Path Traversal Attempt via Webroot Request
Detects path traversal sequences in HTTP requests to Vivotek camera CGI endpoints attempting to access files outside the webroot, consistent with CVE-2025-66051. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Vivotek Camera Path Traversal Attempt via Webroot Request
id: 9f0c7968-08b7-57f9-8de2-24714e882dcc
status: experimental
description: Detects directory traversal sequences (../ or encoded equivalents) in
requests to camera CGI/web endpoints, consistent with unauthorized file access outside
the webroot as described in CVE-2025-66051.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1083
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: .cgi
traversal:
cs-uri-query|contains:
- ../
- ..%2f
- ..%5c
- '%2e%2e%2f'
condition: selection and traversal
falsepositives:
- Vulnerability scanning tools intentionally probing for traversal issues during authorized
assessments
level: medium
Unauthenticated RTSP Stream Access to Camera Service Port 8554
Detects inbound network connections to TCP/8554, the RTSP port exposed by vulnerable Vivotek IP7137 cameras allowing unauthenticated live stream viewing per CVE-2025-66049. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated RTSP Stream Access to Camera Service Port 8554
id: 29230d17-8ece-52ae-b418-e868e3f30454
status: experimental
description: Detects network connections to TCP port 8554, the RTSP streaming port
used by Vivotek IP7137 cameras, originating from hosts outside expected camera management
subnets. Combined with lack of prior authentication traffic, this can indicate exploitation
of CVE-2025-66049 unauthenticated RTSP stream access.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1078.001
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 8554
filter:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate NVR/VMS servers on internal management subnets pulling RTSP streams from
the camera
- Authorized network monitoring tools scanning known camera inventory
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-66049
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free