What is CVE-2025-9983?

CVE-2025-9983 is a vulnerability in Galayou G2, classified under Missing Authentication for Critical Function. Published 2025-09-22.

Is CVE-2025-9983 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Galayou G2

CVE-2025-9983

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.

Vulnerability class: Broken Authentication

EPSS: 0.006 (47.5th percentile) — read the EPSS interpretation.

Affected products

Galayou G2 — versions 11.100001.01.28

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cvd@cert.pl (third-party-advisory)
cvd@cert.pl (product)

Frequently asked questions

What is CVE-2025-9983?: CVE-2025-9983 is a vulnerability in Galayou G2, classified under Missing Authentication for Critical Function. Published 2025-09-22.
Is CVE-2025-9983 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.