Vivotek IP7137 cameras expose critical flaws, no fix planned
Vivotek IP7137 cameras contain four critical vulnerabilities allowing unauthenticated access to live feeds, default admin credentials, path traversal, and command injection; no fix expected as product is EOL.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of four vulnerabilities affecting Vivotek IP7137 IP cameras. The most severe issue (CVE-2025-66049) allows unauthorized viewing of live camera footage via RTSP on port 8554 without authentication, directly compromising user privacy. Additionally, the camera ships with no default administrator password (CVE-2025-66050), leaving devices completely exposed unless users proactively configure authentication.
Authenticated attackers can exploit path traversal (CVE-2025-66051) to access files outside the webroot directory and perform command injection (CVE-2025-66052) via the unsanitized system_ntpIt parameter in the setparam.cgi endpoint. The command injection vulnerability is particularly dangerous when combined with the default passwordless admin access, effectively allowing unauthenticated remote code execution.
The vendor did not respond to disclosure attempts, and since the Vivotek IP7137 has reached End-Of-Life status, no patches are expected. All firmware versions are believed affected, with testing conducted on version 0200a. Organizations using these cameras should immediately isolate them from network access or replace them with supported alternatives.
Mentioned in this report
Detection guidance
Vivotek Camera setparam.cgi system_ntp Command Injection Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the Vivotek setparam.cgi endpoint containing shell metacharacters in the system_ntp parameter, indicative of CVE-2025-66052 command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Vivotek Camera setparam.cgi system_ntp Command Injection Attempt
id: bc1277fc-28b4-57f5-b78d-3e7264869843
status: experimental
description: Detects HTTP requests to the Vivotek setparam.cgi endpoint where the
system_ntp parameter contains shell metacharacters or command separators, consistent
with unauthenticated remote code execution via CVE-2025-66052.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: setparam.cgi
injection:
cs-uri-query|contains:
- system_ntp=
metachars:
cs-uri-query|contains:
- ;
- '|'
- '`'
- $(
- '&&'
- '%0a'
- '%0d'
condition: selection and injection and metachars
falsepositives:
- Legitimate NTP configuration changes made through the camera admin UI that unusually
include punctuation in the value (rare)
level: high
Vivotek Camera Path Traversal Attempt via Webroot Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects path traversal sequences in HTTP requests to Vivotek camera CGI endpoints attempting to access files outside the webroot, consistent with CVE-2025-66051. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Vivotek Camera Path Traversal Attempt via Webroot Request
id: 9f0c7968-08b7-57f9-8de2-24714e882dcc
status: experimental
description: Detects directory traversal sequences (../ or encoded equivalents) in
requests to camera CGI/web endpoints, consistent with unauthorized file access outside
the webroot as described in CVE-2025-66051.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1083
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: .cgi
traversal:
cs-uri-query|contains:
- ../
- ..%2f
- ..%5c
- '%2e%2e%2f'
condition: selection and traversal
falsepositives:
- Vulnerability scanning tools intentionally probing for traversal issues during authorized
assessments
level: medium
Unauthenticated RTSP Stream Access to Camera Service Port 8554
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects inbound network connections to TCP/8554, the RTSP port exposed by vulnerable Vivotek IP7137 cameras allowing unauthenticated live stream viewing per CVE-2025-66049. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated RTSP Stream Access to Camera Service Port 8554
id: 29230d17-8ece-52ae-b418-e868e3f30454
status: experimental
description: Detects network connections to TCP port 8554, the RTSP streaming port
used by Vivotek IP7137 cameras, originating from hosts outside expected camera management
subnets. Combined with lack of prior authentication traffic, this can indicate exploitation
of CVE-2025-66049 unauthenticated RTSP stream access.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1078.001
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 8554
filter:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate NVR/VMS servers on internal management subnets pulling RTSP streams from
the camera
- Authorized network monitoring tools scanning known camera inventory
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-66049
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs