CVE-2025-9983

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior.The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

CVSS v4.0

7.1 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.68% chance of exploitation in the next 30 days, 50th percentile

Published

2025-09-22

Proof-of-concept exploits (1)

• sohaibeb/CVE-2025-9983

References

• CVE Record
• NVD entry

Related

• CVE-2023-20198
• CVE-2025-0108
• CVE-2025-55182
• CVE-2025-9978
• CVE-2025-9985
• CVE-2025-9961