Vivotek IP7137 cameras exposed via authentication flaws
End-of-life Vivotek IP7137 cameras have critical authentication bypass and information disclosure flaws enabling unauthenticated RTSP stream access and administrative control.
CERT Polska has disclosed four vulnerabilities in Vivotek IP7137 IP cameras, a product now at end-of-life with no patch expected. CVE-2025-66049 allows unauthenticated access to live camera feeds via RTSP on port 8554, directly exposing video streams without credentials. CVE-2025-66050 reveals that the camera ships with no default administrator password requirement, leaving admin panels open by default unless users proactively configure authentication.
Two additional vulnerabilities affect authenticated sessions: CVE-2025-66051 enables path traversal attacks to access files outside the webroot, and CVE-2025-66052 permits command injection via the system_ntpIt parameter in the setparam.cgi endpoint. However, because administrative access is unprotected by default (CVE-2025-66050), these latter flaws effectively require no authentication to exploit. The vendor did not respond to disclosure attempts.
All firmware versions are believed affected, with testing conducted on version 0200a. Organizations deploying these cameras face immediate privacy and security risks from unauthorized surveillance and potential device compromise. Replacement with supported hardware is the only remediation path.
Mentioned in this report
Detection guidance
Command Injection Attempt via Vivotek setparam.cgi system_ntpIt Parameter
Detects HTTP requests to Vivotek camera setparam.cgi endpoint with command injection metacharacters in the system_ntpIt parameter (CVE-2025-66052). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Attempt via Vivotek setparam.cgi system_ntpIt Parameter
id: d8d14025-c951-5d07-a2d4-2f3dc928d018
status: experimental
description: Detects exploitation attempts against Vivotek IP7137 cameras where the
system_ntpIt parameter of setparam.cgi is used to inject OS commands. Because the
admin panel is open by default (CVE-2025-66050), this can be triggered without authentication.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1212
- attack.t1059
logsource:
category: proxy
product: web
detection:
selection_endpoint:
cs-uri-stem|contains: setparam.cgi
cs-uri-query|contains: system_ntpIt
selection_injection:
cs-uri-query|contains:
- ;
- '|'
- '`'
- $(
- '&&'
- '%0a'
- '%0d'
condition: selection_endpoint and selection_injection
falsepositives:
- Legitimate NTP configuration changes that unexpectedly include shell-like characters
in free-text fields (rare)
level: high
Path Traversal Attempt Against Vivotek Camera Web Interface
Detects HTTP requests containing directory traversal sequences targeting Vivotek IP7137 camera CGI endpoints to access files outside the webroot (CVE-2025-66051). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Attempt Against Vivotek Camera Web Interface
id: 5cd1c35a-b09f-5a15-8ea0-07dfa38c27e5
status: experimental
description: Detects path traversal patterns (../ or encoded equivalents) in HTTP
requests to camera CGI endpoints, consistent with exploitation of CVE-2025-66051
on Vivotek IP7137 devices to read files outside the webroot.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1078
logsource:
category: proxy
product: web
detection:
selection_cgi:
cs-uri-stem|contains: .cgi
selection_traversal:
cs-uri-stem|contains:
- ../
- ..%2f
- ..%5c
- '%2e%2e%2f'
condition: selection_cgi and selection_traversal
falsepositives:
- Vulnerability scanning tools performing authorized security assessments against
the device
level: high
Unauthenticated RTSP Connection to Vivotek Camera Streaming Port
Detects network connections to TCP/8554 RTSP service on Vivotek IP7137 cameras, which exposes live video feeds without any authentication (CVE-2025-66049). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated RTSP Connection to Vivotek Camera Streaming Port
id: 331d26e9-2aa4-5979-921b-b9af3cb80411
status: experimental
description: Detects inbound connections to TCP port 8554 (RTSP) commonly used by
Vivotek IP7137 cameras, which per CVE-2025-66049 stream live video without requiring
credentials. Useful for identifying unexpected external or lateral access to camera
streams, especially from hosts not normally associated with video management systems.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 8554
filter_known_vms:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_known_vms
falsepositives:
- Legitimate internal video management system (VMS) or NVR connections retrieving
RTSP streams from cameras on the internal network
- Network monitoring tools probing camera health/status on the same port
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-66049
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free