What’s Vulnerable › Vulnerabilities

CVE-2025-9983: Lack of Authentication for RTSP stream

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-22 · updated 2026-06-17
• Weakness: CWE-306

Description

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

Affected products

• GALAYOU G2: 11.100001.01.28

References

• https://cert.pl/en/posts/2025/09/CVE-2025-9983
• https://www.galayou-store.com/g2

Get alerted when CVE-2025-9983 or the next vulnerability affects your stack