Onbeschermde RTSP stream in Vivotek IP7137 camera's

The primary impact of this vulnerability is the unauthorized viewing of live camera footage. An attacker with network access can exploit this flaw to gain visual surveillance of areas covered by the camera, potentially revealing sensitive information or activities. This could be used for malicious purposes such as theft, vandalism, or stalking. The blast radius extends to anyone who could access the network where the camera is deployed. While no direct data exfiltration is possible through this vulnerability, the visual information obtained could be used in conjunction with other attacks or for reconnaissance purposes. The lack of authentication makes this vulnerability particularly concerning, as it requires minimal effort to exploit.

Organizations utilizing Vivotek IP7137 cameras in environments where visual surveillance is critical, such as retail stores, schools, or office buildings, are at significant risk. Specifically, deployments where the camera is accessible from untrusted networks or shared hosting environments are particularly vulnerable. Legacy installations that have not been regularly updated or secured are also at increased risk.

• windows / supply-chain: Monitor network traffic for connections to the IP7137 camera on port 8554. • linux / server: Use ss -tulnp | grep 8554 to identify processes listening on port 8554. • generic web: Use curl -v <camera_ip>:8554 to check for RTSP stream exposure without authentication.

1. 2026-01-09Disclosure

   disclosure

1. Gereserveerd2025-11-21
2. Gepubliceerd2026-01-09
3. EPSS bijgewerkt2026-03-23

Given that a security patch is not expected from the vendor due to the product's End-of-Life status, mitigation strategies should focus on network segmentation and access control. Isolate the IP7137 camera on a separate VLAN with restricted access. Implement firewall rules to block external access to port 8554 and only allow connections from trusted internal IP addresses. Consider disabling the RTSP service entirely if it is not essential. Regularly monitor network traffic for suspicious activity. Since a patch is unavailable, a rollback to a previous firmware version is not possible. Carefully evaluate the risks associated with continuing to use this device and consider replacing it with a supported model.