Unpatched & Exposed: Legacy Vivotek Cameras Broadcast Live Video to All

Legacy Vivotek IP7137 cameras are described as having four critical vulnerabilities disclosed by CERT Polska, with no patch expected due to the product being End-Of-Life.

According to CERT Polska, the flaws range from unauthorised video streaming to remote command injection, and the advisory warns that “possibly all firmware versions are affected.” The most serious issue is CVE-2025-66049, a high-severity flaw (CVSS 8.7) that allows live camera footage to be accessed via RTSP on port 8554 without authentication, effectively turning the device into a public broadcaster.

Also noted is CVE-2025-66050, with a CVSS of 9.3, where the camera does not require a password for administrator login by default, and a system that fails to prompt for a password even when one is set. If an attacker gains administrative access, CVE-2025-66052 in the /cgi-bin/admin/setparam.cgi endpoint enables arbitrary command execution, while CVE-2025-66051 provides a path traversal vulnerability allowing access to resources outside the webroot. The report urges decommissioning or isolating these cameras from untrusted networks to mitigate the risk.