PT-2025-26655 · Noyafa · Noyafa/Xiami Lf9 Pro

Geochen · Published 2025-06-24 · Updated 2025-06-24 · CVE-2025-6532

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NOYAFA/Xiami LF9 Pro up to 20250611

Description: A problematic vulnerability was found in the RTSP Live Video Stream Endpoint component of the NOYAFA/Xiami LF9 Pro device. This issue leads to improper access controls, allowing for unauthorized access or manipulation of video streams. The attack can only be initiated within the local network. The exploit has been disclosed to the public.

Recommendations: For NOYAFA/Xiami LF9 Pro up to 20250611, consider restricting access to the RTSP Live Video Stream Endpoint to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-6532

Affected Products

Noyafa/Xiami Lf9 Pro

References · 12

• 🔥 https://github.com/geo-chen/LF9?tab=readme-ov-file#finding-1-unauthenticated-access-of-livestream-and-download-of-video-recordings · Exploit
• 🔥 https://github.com/geo-chen/LF9 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6532 · Security Note
• https://twitter.com/transilienceai/status/1937371096606814387 · Twitter Post
• https://vuldb.com/?submit.595453 · Note
• https://twitter.com/transilienceai/status/1937371100511625645 · Twitter Post
• https://vuldb.com/?ctiid.313651 · Note
• https://vuldb.com/?id.313651 · Note
• https://twitter.com/transilienceai/status/1937371097558831569 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937319677601943750 · Twitter Post
• https://twitter.com/CVEnew/status/1937344581273588103 · Twitter Post