CVE-2025-6532
NOYAFA/Xiami LF9 Pro RTSP Live Video Stream Endpoint access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 24, 2025
- Updated
- Jun 25, 2025
- Reserved
- Jun 23, 2025
Description
A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple resellers and different names.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R | VulDB |
| 2.0 | 3.3 Low | AV:A/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
LF9 ProNOYAFA |
|
LF9 ProXiami |
|
References
- VDB-313651 | NOYAFA/Xiami LF9 Pro RTSP Live Video Stream Endpoint access controlvdb-entry
- VDB-313651 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
- Submit #595453 | HiDvr dashcam LF9 Pro Improper Access Controlsthird-party-advisory
- https://github.com/geo-chen/LF9related
- https://github.com/geo-chen/LF9?tab=readme-ov-file#finding-1-unauthenticated-access-of-livestream-and-download-of-video-recordingsexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.