Paper/Archive/CVE-2025-66050

CVE-2025-66050

Vivotek IP7137 — No password set for administrative account in Vivotek IP7137 cameras

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 33.0.330 × 206.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.

Affected

ProductAffectedFixed inSource

IP71370200a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/posts/2026/01/CVE-2025-66049