Information Disclosure Vulnerability in Vivotek IP7137 Camera
CVE-2025-66049

8.7HIGH

Key Information:

Vendor

Vivotek

Status
Ip7137
Vendor
CVE Published:
9 January 2026

What is CVE-2025-66049?

The Vivotek IP7137 camera is susceptible to an information disclosure vulnerability that allows unauthorized access to real-time video streams. This issue arises due to insufficient authentication measures implemented in the RTSP protocol on port 8554, allowing anyone with network access to view the camera feeds without any form of credential verification. As the product has reached its End-Of-Life status, it is unlikely that a patch will be provided, leaving users exposed to potential privacy breaches and security risks.

Affected Version(s)

IP7137 0200a

References

https://cert.pl/posts/2026/01/CVE-2025-66049
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Szymon Paszun
JSON
.