Auth bypass in Galayou G2
CVE-2025-9983
GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.
Vulnerability class: Broken Authentication
Published · last modified .
EPSS exploit prediction
EPSS: 0.007 (50.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Galayou G2 — versions 11.100001.01.28
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/en/posts/2025/09/CVE-2025-9983 (third-party-advisory)
- www.galayou-store.com/g2 (product)
Frequently asked questions
- What is CVE-2025-9983?
- CVE-2025-9983 is a vulnerability in Galayou G2, classified under Missing Authentication for Critical Function. Published 2025-09-22.
- Is CVE-2025-9983 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.