CVE-2025-9983CWE-306

Lack of Authentication for RTSP stream

High · published September 22, 2025

CVSS v4.0

7.1

EPSS

Percentile

51.9

In the wild

Unconfirmed

What it is

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior.

The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

The record

Technical detail

CVSS v4.0: 7.1 · HIGH
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00682 · 51.9th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2025-09-22T11:06Z

EPSS history

Timeline

22 SEP 11:06Z
Lack of Authentication for RTSP stream
cvelistv5