CVE-2025-6532 | THREATINT

Description

A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple resellers and different names.

In NOYAFA/Xiami LF9 Pro bis 20250611 wurde eine problematische Schwachstelle entdeckt. Das betrifft eine unbekannte Funktionalität der Komponente RTSP Live Video Stream Endpoint. Durch Manipulieren mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann im lokalen Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.

Reserved 2025-06-23 | Published 2025-06-24 | Updated 2025-06-24 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

MEDIUM: 4.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R

MEDIUM: 4.3CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R

3.3AV:A/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR

Problem types

Improper Access Controls

Incorrect Privilege Assignment

Product status

20250611

affected

20250611

affected

Timeline

2025-06-23:	Advisory disclosed
2025-06-23:	VulDB entry created
2025-06-23:	VulDB entry last update

Credits

geochen (VulDB User) reporter

References

vuldb.com/?id.313651 (VDB-313651 | NOYAFA/Xiami LF9 Pro RTSP Live Video Stream Endpoint access control) vdb-entry

vuldb.com/?ctiid.313651 (VDB-313651 | CTI Indicators (IOB, IOC, TTP)) signature permissions-required

vuldb.com/?submit.595453 (Submit #595453 | HiDvr dashcam LF9 Pro Improper Access Controls) third-party-advisory

github.com/geo-chen/LF9 related

github.com/geo-chen/LF9?tab=readme-ov-file exploit

cve.org (CVE-2025-6532)

nvd.nist.gov (CVE-2025-6532)

Download JSON