Vivotek IP7137 cameras exposed via authentication flaws
End-of-life Vivotek IP7137 cameras have critical authentication bypass and information disclosure flaws enabling unauthenticated RTSP stream access and administrative control.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has disclosed four vulnerabilities in Vivotek IP7137 IP cameras, a product now at end-of-life with no patch expected. CVE-2025-66049 allows unauthenticated access to live camera feeds via RTSP on port 8554, directly exposing video streams without credentials. CVE-2025-66050 reveals that the camera ships with no default administrator password requirement, leaving admin panels open by default unless users proactively configure authentication.
Two additional vulnerabilities affect authenticated sessions: CVE-2025-66051 enables path traversal attacks to access files outside the webroot, and CVE-2025-66052 permits command injection via the system_ntpIt parameter in the setparam.cgi endpoint. However, because administrative access is unprotected by default (CVE-2025-66050), these latter flaws effectively require no authentication to exploit. The vendor did not respond to disclosure attempts.
All firmware versions are believed affected, with testing conducted on version 0200a. Organizations deploying these cameras face immediate privacy and security risks from unauthorized surveillance and potential device compromise. Replacement with supported hardware is the only remediation path.
Mentioned in this report
Detection guidance
Path Traversal Attempt Against Vivotek Camera Web Interface
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing directory traversal sequences targeting Vivotek IP7137 camera CGI endpoints to access files outside the webroot (CVE-2025-66051). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Attempt Against Vivotek Camera Web Interface
id: 5cd1c35a-b09f-5a15-8ea0-07dfa38c27e5
status: experimental
description: Detects path traversal patterns (../ or encoded equivalents) in HTTP
requests to camera CGI endpoints, consistent with exploitation of CVE-2025-66051
on Vivotek IP7137 devices to read files outside the webroot.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1078
logsource:
category: proxy
detection:
selection_cgi:
cs-uri-stem|contains: .cgi
selection_traversal:
cs-uri-stem|contains:
- ../
- ..%2f
- ..%5c
- '%2e%2e%2f'
condition: selection_cgi and selection_traversal
falsepositives:
- Vulnerability scanning tools performing authorized security assessments against
the device
level: high
Unauthenticated RTSP Connection to Vivotek Camera Streaming Port
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connections to TCP/8554 RTSP service on Vivotek IP7137 cameras, which exposes live video feeds without any authentication (CVE-2025-66049). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated RTSP Connection to Vivotek Camera Streaming Port
id: 331d26e9-2aa4-5979-921b-b9af3cb80411
status: experimental
description: Detects inbound connections to TCP port 8554 (RTSP) commonly used by
Vivotek IP7137 cameras, which per CVE-2025-66049 stream live video without requiring
credentials. Useful for identifying unexpected external or lateral access to camera
streams, especially from hosts not normally associated with video management systems.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 8554
filter_known_vms:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_known_vms
falsepositives:
- Legitimate internal video management system (VMS) or NVR connections retrieving
RTSP streams from cameras on the internal network
- Network monitoring tools probing camera health/status on the same port
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-66049
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs