# Vivotek IP7137 cameras exposed via authentication flaws

Published: 2026-01-09 · Severity: routine
Canonical: https://vorant.io/reports/a9e60134-c2a6-5d35-b2bb-4709f5a9d2c1/vivotek-ip7137-cameras-exposed-via-authentication-flaws

> End-of-life Vivotek IP7137 cameras have critical authentication bypass and information disclosure flaws enabling unauthenticated RTSP stream access and administrative control.

CERT Polska has disclosed four vulnerabilities in Vivotek IP7137 IP cameras, a product now at end-of-life with no patch expected. CVE-2025-66049 allows unauthenticated access to live camera feeds via RTSP on port 8554, directly exposing video streams without credentials. CVE-2025-66050 reveals that the camera ships with no default administrator password requirement, leaving admin panels open by default unless users proactively configure authentication.

Two additional vulnerabilities affect authenticated sessions: CVE-2025-66051 enables path traversal attacks to access files outside the webroot, and CVE-2025-66052 permits command injection via the system_ntpIt parameter in the setparam.cgi endpoint. However, because administrative access is unprotected by default (CVE-2025-66050), these latter flaws effectively require no authentication to exploit. The vendor did not respond to disclosure attempts.

All firmware versions are believed affected, with testing conducted on version 0200a. Organizations deploying these cameras face immediate privacy and security risks from unauthorized surveillance and potential device compromise. Replacement with supported hardware is the only remediation path.

## Mentioned in this report

- Vulnerabilities: CVE-2025-66049, CVE-2025-66050, CVE-2025-66051, CVE-2025-66052

## Detection guidance (public sample)

### Command Injection Attempt via Vivotek setparam.cgi system_ntpIt Parameter

ATT&CK: T1190

Detects HTTP requests to Vivotek camera setparam.cgi endpoint with command injection metacharacters in the system_ntpIt parameter (CVE-2025-66052). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Attempt via Vivotek setparam.cgi system_ntpIt Parameter
id: d8d14025-c951-5d07-a2d4-2f3dc928d018
status: experimental
description: Detects exploitation attempts against Vivotek IP7137 cameras where the
  system_ntpIt parameter of setparam.cgi is used to inject OS commands. Because the
  admin panel is open by default (CVE-2025-66050), this can be triggered without authentication.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1212
- attack.t1059
logsource:
  category: proxy
  product: web
detection:
  selection_endpoint:
    cs-uri-stem|contains: setparam.cgi
    cs-uri-query|contains: system_ntpIt
  selection_injection:
    cs-uri-query|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
    - '%0a'
    - '%0d'
  condition: selection_endpoint and selection_injection
falsepositives:
- Legitimate NTP configuration changes that unexpectedly include shell-like characters
  in free-text fields (rare)
level: high
```

### Path Traversal Attempt Against Vivotek Camera Web Interface

ATT&CK: T1190

Detects HTTP requests containing directory traversal sequences targeting Vivotek IP7137 camera CGI endpoints to access files outside the webroot (CVE-2025-66051). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Path Traversal Attempt Against Vivotek Camera Web Interface
id: 5cd1c35a-b09f-5a15-8ea0-07dfa38c27e5
status: experimental
description: Detects path traversal patterns (../ or encoded equivalents) in HTTP
  requests to camera CGI endpoints, consistent with exploitation of CVE-2025-66051
  on Vivotek IP7137 devices to read files outside the webroot.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1190
- attack.t1078
logsource:
  category: proxy
  product: web
detection:
  selection_cgi:
    cs-uri-stem|contains: .cgi
  selection_traversal:
    cs-uri-stem|contains:
    - ../
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
  condition: selection_cgi and selection_traversal
falsepositives:
- Vulnerability scanning tools performing authorized security assessments against
  the device
level: high
```

### Unauthenticated RTSP Connection to Vivotek Camera Streaming Port

ATT&CK: T1078

Detects network connections to TCP/8554 RTSP service on Vivotek IP7137 cameras, which exposes live video feeds without any authentication (CVE-2025-66049). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated RTSP Connection to Vivotek Camera Streaming Port
id: 331d26e9-2aa4-5979-921b-b9af3cb80411
status: experimental
description: Detects inbound connections to TCP port 8554 (RTSP) commonly used by
  Vivotek IP7137 cameras, which per CVE-2025-66049 stream live video without requiring
  credentials. Useful for identifying unexpected external or lateral access to camera
  streams, especially from hosts not normally associated with video management systems.
references:
- CERT Polska Vivotek IP7137 disclosure
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 8554
  filter_known_vms:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_known_vms
falsepositives:
- Legitimate internal video management system (VMS) or NVR connections retrieving
  RTSP streams from cameras on the internal network
- Network monitoring tools probing camera health/status on the same port
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-66049

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a9e60134-c2a6-5d35-b2bb-4709f5a9d2c1/vivotek-ip7137-cameras-exposed-via-authentication-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup