CVE-2025-9983 — Lack of Authentication for RTSP stream

CVE-2025-9983

Lack of Authentication for RTSP stream PUBLISHED

Description (CNA)

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

Affected (CNA)

Vendor / product	Versions
GALAYOU / G2	affected 11.100001.01.28

CWE

CWE-306

References

https://cert.pl/en/posts/2025/09/CVE-2025-9983
https://www.galayou-store.com/g2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.