CVE-2025-66050: No password set for administrative account in Vivotek IP7137 cameras
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66050?
CVE-2025-66050 is considered a high severity vulnerability due to the lack of a default password for administrator access.
How do I fix CVE-2025-66050?
To mitigate CVE-2025-66050, users should set a strong password for the administrator account immediately after installing the Vivotek IP7137 camera.
What are the potential risks associated with CVE-2025-66050?
The potential risks include unauthorized access to the camera's settings and video feeds, which could compromise privacy and security.
Is CVE-2025-66050 present in all versions of the Vivotek IP7137?
CVE-2025-66050 affects the Vivotek IP7137 camera running firmware version 0200a or earlier.
Can I continue to use my Vivotek IP7137 camera if it is affected by CVE-2025-66050?
Yes, you can continue to use the camera, but it is crucial to set an administrator password to protect against unauthorized access.