PT-2026-1853 · Vivotek · Ip7137

Szymon Paszun · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2025-66049

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vivotek IP7137 camera versions prior to 0200a

Description The Vivotek IP7137 camera is affected by an information disclosure issue. Live camera footage can be accessed through the Real Time Streaming Protocol (RTSP) on port 8554 without authentication. This allows unauthorized network users to view the camera feed, potentially compromising privacy and security. The vendor has not responded to reports of this issue, and as the product is in its End-Of-Life phase, a fix is not expected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

OS Command Injection

Path traversal

Enumeração de Fraquezas

CWE-306

CWE-78

CWE-1393

CWE-22

Identificadores relacionados

BDU:2026-00867

BDU:2026-00868

BDU:2026-00869

BDU:2026-00870

CVE-2025-66049

Produtos afetados

Ip7137

Referências · 9

• https://cert.pl/posts/2026/01/CVE-2025-66049 · Nota
• https://osv.dev/vulnerability/CVE-2025-66049 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-00868 · Nota de Segurança
• https://t.me/CVEtracker/41837 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2026-00867 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-00870 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-00869 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-66049 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009604616506245537 · Publicação no Twitter