CVE-2025-9983

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

• CWE-306

• https://cert.pl/en/posts/2025/09/CVE-2025-9983
• https://www.galayou-store.com/g2

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9977Value provided in one of POST parameters sent during the pro…5.3
• CVE-2025-9978The Jeg Kit for Elementor WordPress plugin before 2.7.0 doe…6.8
• CVE-2025-9979The Maspik plugin for WordPress is vulnerable to Missing Aut…4.3
• CVE-2025-9980QuickCMS is vulnerable to multiple Stored XSS in page editor…4.8
• CVE-2025-9981QuickCMS is vulnerable to multiple Stored XSS in slider edit…4.8
• CVE-2025-9982A vulnerability exists in QuickCMS version 6.8 where sensiti…7.5
• CVE-2025-9984The Featured Image from URL (FIFU) plugin for WordPress is v…5.3
• CVE-2025-9985The Featured Image from URL (FIFU) plugin for WordPress is v…5.3
• CVE-2025-9986Exposure of Sensitive System Information to an Unauthorized …8.2
• CVE-2025-9987The Broadstreet plugin for WordPress is vulnerable to Sensit…5.3
• CVE-2025-9988The Broadstreet plugin for WordPress is vulnerable to unauth…4.3
• CVE-2025-9989The Broadstreet plugin for WordPress is vulnerable to Stored…4.4