Vivotek IP7137 Path Traversal Vulnerability

A path traversal vulnerability has been identified in the Vivotek IP7137 camera, specifically in firmware version 0200a. This vulnerability allows an authenticated attacker to access files and resources outside the webroot directory by sending a direct HTTP request. Additionally, due to another vulnerability (CVE-2025-66050), the camera's administration panel does not require a password by default, potentially allowing unauthorized access. The manufacturer has not responded to the vulnerability report, and no fix is expected since the product has reached its End-of-Life phase.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files and resources on the camera, potentially allowing for further exploitation or manipulation of the device.