Vulnerability · Published Sep 22, 2025 · Assigned by CERT-PL

CVE-2025-9983Lack of Authentication for RTSP stream

High 7.1

In plain English

A high-severity missing authentication in G2 from GALAYOU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

Affected products (as reported)

Vendor	Product	Versions
GALAYOU	G2	11.100001.01.28

Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/09/CVE-2025-9983 third-party-advisory
https://www.galayou-store.com/g2 product