CVE-2025-66050

The default firmware configuration allows login to the administrator account without entering any password. Although the interface allows password configuration, the user is not informed of this need or prompted to set it. As a result, devices exposed to network access remain unsecured, and attackers with network access can obtain full administrative privileges without any authorization.

An unauthenticated remote attacker gains full administrative access to the camera, enabling device takeover, video stream manipulation, configuration changes, or using the camera as an entry point for further network activities.

The manufacturer did not respond to the report and does not plan to release a patch due to the product's End-of-Life status. It is recommended to immediately manually set a strong administrator password in the device interface, isolate cameras from public networks (e.g., using a firewall or dedicated VLAN segment), and ultimately replace the device with a supported model. Consult with the manufacturer's references and the CERT Poland publication.

Vivotek IP7137 with firmware version 0200a; according to the description, the issue may affect all firmware versions. The product has reached End-of-Life status.