Full Report
CERT Polska has received a report about 4 vulnerabilities (from CVE-2025-66049 to CVE-2025-66052) found in Vivotek IP7137 camera.
Analysis Summary
This summary compiles the details for four vulnerabilities reported in the Vivotek IP7137 camera firmware.
***
# Vulnerability: Multiple Flaws in Vivotek IP7137 Camera Firmware
## CVE Details
Due to the report covering four distinct CVEs, details are provided for each:
| CVE ID | CWE | Technical Description Summary | CVSS Score | Severity |
| :--- | :--- | :--- | :--- | :--- |
| CVE-2025-66049 | CWE-306 (Missing Authentication) | Unauthorized access to live camera footage via RTSP (port 8554). | N/A | N/A |
| CVE-2025-66050 | CWE-1393 (Use of Default Password) | Administrator login does not enforce password setup by default. | N/A | N/A |
| CVE-2025-66051 | CWE-22 (Path Traversal) | Authenticated user can access resources outside the webroot via direct HTTP requests. | N/A | N/A |
| CVE-2025-66052 | CWE-78 (OS Command Injection) | Unsanitized input to the `system_ntpIt` parameter in `/cgi-bin/admin/setparam.cgi` allows administrative command execution. | N/A | N/A |
*Note: Specific CVSS scores were not provided in the source material.*
## Affected Systems
- **Products:** Vivotek IP7137 Camera
- **Versions:** Version `0200a` (The vendor has not replied, suggesting all firmware versions may be affected as the product is End-of-Life).
- **Configurations:** Standard operating configurations. Note that CVE-2025-66050 implies default configuration allows administrative login without a password.
## Vulnerability Description
**CVE-2025-66049 (Information Disclosure via RTSP):** Allows unauthorized users to view live camera feeds over the RTSP protocol (port 8554) without any authentication.
**CVE-2025-66050 (Weak Default Credentials):** The device allows login as an administrator by default without requiring a password to be set, though setting one is possible.
**CVE-2025-66051 (Path Traversal):** An authenticated attacker can utilize path traversal techniques in HTTP requests to read arbitrary files outside the intended webroot directory.
**CVE-2025-66052 (OS Command Injection):** An attacker with administrative privileges can exploit improper sanitization of the `system_ntpIt` parameter within the `/cgi-bin/admin/setparam.cgi` endpoint to execute arbitrary operating system commands. This is highly dangerous given the weak default authentication (CVE-2025-66050).
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild, but PoC is implied by the nature of the findings (especially command injection dependent on default credentials).
- **Complexity:** Complexity for initial unauthorized access is **Low** due to CVE-2025-66050. Exploiting Command Injection (CVE-2025-66052) requires administrative access, which is low complexity to obtain initially.
- **Attack Vector:** Primarily **Network** for all vulnerabilities, accessing the device interface or RTSP port.
## Impact
- **Confidentiality:** High (Exposure of live camera feeds and potential file system access).
- **Integrity:** High (Ability to execute arbitrary OS commands via CVE-2025-66052).
- **Availability:** Medium to High (OS command execution could potentially lead to device instability or denial of service).
## Remediation
### Patches
- **Status:** No fix is expected to be released as the product has reached End-Of-Life.
### Workarounds
1. **Network Segmentation:** Isolate the Vivotek IP7137 camera from untrusted networks. Access should be restricted via firewall rules, allowing connections only from trusted management segments.
2. **Credential Hardening (If Possible):** If the firmware allows setting the administrator password prior to exploitation, **immediately set a strong, unique password** to mitigate CVE-2025-66050, which is a prerequisite for using CVE-2025-66051 and CVE-2025-66052 effectively.
3. **Disable RTSP:** If the RTSP functionality (port 8554) is not required, ensure it is disabled in the device configuration to mitigate CVE-2025-66049.
## Detection
- **Indicators of Compromise (IOCs):**
* Unusual outbound network connections originating from the camera device.
* Log entries showing successful access to the RTSP stream (port 8554) from unknown IPs.
* Configuration changes or unexpected system command executions logged via web interface access around the time of the vulnerability report.
- **Detection Methods and Tools:**
* Network monitoring tools (e.g., IDS/IPS) configured to alert on unauthenticated RTSP connections to port 8554 referencing the camera's IP address.
* Review system logs for calls to `/cgi-bin/admin/setparam.cgi` with suspicious parameters related to network time protocol settings.
## References
- CERT Polska Advisory: (The source article itself is the primary reference.)
- CVE Records: CVE-2025-66049, CVE-2025-66050, CVE-2025-66051, CVE-2025-66052
- Coordinated Vulnerability Disclosure Process: hXXps://cert.pl/en/cvd/