CVE-2025-66050 is a critical flaw (CVSS 9.8) in the Vivotek IP7137 camera. Firmware 0200a does not require a password for the administrator account by default. The device is end of life and the CNA says no fix is expected, so the answer is to set a password, isolate the camera, or replace it.
What's affected
- Vivotek IP7137 camera with firmware version 0200a, confirmed in the record.
- The CNA says possibly all firmware versions are affected, because the vendor did not reply.
- Fixed version: none. The product has reached end of life and the CNA does not expect a patch.
How to check if you're exposed
Open the camera's web interface from a trusted machine on the same network and see whether the admin page loads without asking for credentials. Do this only on devices you own or manage.
Then look at your network inventory. Any IP7137 on a flat network, or reachable from the internet through port forwarding, is the case that matters most. Your router's port forward list and a search of your asset inventory for the model name will find them.
What to do now
- Set a strong, unique administrator password on every IP7137 now. The record notes that the interface does not tell users this is needed.
- Remove any port forward or public exposure for the camera.
- Move the camera to its own VLAN with no route to business systems, and limit who can reach its web interface.
- Plan replacement. With no vendor fix, a supported camera is the durable answer.
- Record the device in your asset list with an end of life flag so it does not get forgotten.
For a camera that cannot be patched, think about what it can see and what it can reach. Aim it away from sensitive screens, disable any cloud or remote viewing feature you do not use, and block its access to the internet so it cannot be turned into a relay. Review the footage retention too, since a compromised camera exposes stored video.
Why it matters
The record maps this to CWE-1393, use of a default password. The device ships in a state where administrator access needs no secret at all, and nothing prompts the owner to change that.
Because the attack needs no privileges and no user action, anyone who can reach the camera over the network can act as administrator. Cameras also sit on networks next to other equipment, so an unmanaged one becomes a foothold. The record does not flag this CVE as exploited in the wild.
Quick check
Will Vivotek release a patch for CVE-2025-66050?
The CNA says the product is end of life and a fix is not expected. Set a password, isolate the device, and plan to replace it.
Sources
Last reviewed: 19 October 2026.
