CVE-2025-9983 - GALAYOU G2 RTSP EXPLOIT /!\

Disclaimer: This script is provided 'as is' and exclusively for educational purposes. Users are strongly advised to exercise caution and utilize it within the boundaries of legal and ethical considerations.

Description

Python POC for CVE-2025-9983, an RTSP credential bypass vulnerability in GALAYOU G2 security cameras which allows an unauthenticated threat actor to access live video feeds without valid credentials. The tool works by scanning for accessible RTSP streams and verifying that authentication credentials can be completely bypassed.

Features

• Stream Discovery: Automatically discovers common RTSP stream endpoints.
• Credential Bypass: Verifies authentication bypass by testing streams without credentials.
• Proof Capture: Records video evidence from vulnerable streams.
• Batch Scanning: Checks multiple stream paths simultaneously.
• Error Handling: Handles connection timeouts and network errors gracefully.
• Detailed Reporting: Outputs vulnerable streams with proof of access.

Requirements

• Python 3.x
• FFmpeg tools (ffprobe and ffmpeg)

Usage

python galayou_exploit.py 10.10.12.11

About