CVE-2025-9983
Lack of Authentication for RTSP stream
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 22, 2025
- Updated
- Sep 22, 2025
- Reserved
- Sep 4, 2025
Description
GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior.
The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
G2GALAYOU |
|
References
- https://cert.pl/en/posts/2025/09/CVE-2025-9983third-party-advisory
- https://www.galayou-store.com/g2product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.