CVE-2025-63667 — Vatilon-based IP Cameras Vulnerability Evidence (Sanitized) Summary Vulnerability: Vatilon-based IP cameras issue Session-Id tokens without verifying credential correctness. Impact: Unauthenticated attackers can obtain valid sessions and access administrative data through exposed API endpoints. CVSS: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Affected Devices (Observed) Additional Observations Firmware exposes Telnet service on TCP port 2360. Web UI accepts Basic-style credentials and issues Session-Id tokens regardless of credential validity. Account-listing endpoints may return plaintext pwd fields. Impact Session tokens allow unauthorized access to device APIs. Account list endpoints enable takeover and config changes. Exposed maintenance services increase remote compromise risk. Mitigation / Recommendations 1. Validate credentials before issuing session tokens. 2. Remove plaintext password exposure in API responses; store secure hashes server-side. 3. Enforce proper authentication on all API endpoints. 4. Disable or restrict maintenance services. 5. Apply rate limiting, account lockout, and monitoring for anomalous API access. 6. Harden web server configuration. References NVD Entry CVE.org Entry