CVE-2025-65856
Authentication Bypass in Xiongmai XM530 Cameras Enables Unauthorized Video Access
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xiongmai | xm530 | From 5.00.R02.000807D8.10010.346624.S.ONVIF (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-65856 is a critical authentication bypass vulnerability in the ONVIF implementation of Xiongmai XM530-series IP cameras. It allows unauthenticated remote attackers to access 31 critical ONVIF web service endpoints without any credentials. This happens because the ONVIF SOAP endpoints do not enforce WS-Security authentication and fail to validate security headers, enabling attackers to retrieve sensitive device information, configuration details, live video and audio streams, and control certain device functions. [2]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to unauthorized access to live video and audio streams, full disclosure of device configuration, user account enumeration, PTZ (pan-tilt-zoom) control, relay output manipulation such as alarms, network reconnaissance, and extraction of RTSP credentials. This poses severe privacy risks including mass surveillance and unauthorized monitoring of sensitive environments. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability poses severe privacy risks that violate GDPR requirements by enabling unauthorized access to personal data through live video and audio streams, potentially leading to mass surveillance and data breaches. Such unauthorized access compromises the confidentiality and integrity of personal information, thereby affecting compliance with privacy regulations like GDPR. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending unauthenticated SOAP requests to the ONVIF device service endpoints and checking if sensitive device information is returned without credentials. Devices vulnerable to this issue can be identified by scanning for specific server headers such as "uc-httpd" on port 80 or "XM" on port 8899. Tools like Shodan can be used to find exposed devices. Specific commands would involve crafting SOAP requests to endpoints like GetDeviceInformation or GetStreamUri on ports 80, 8000, 8080, or 8899 and observing the responses for authentication bypass. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include isolating the affected cameras on VLANs without internet access, blocking inbound traffic on the affected ports (80, 8000, 8080, 8899, 554), disabling ONVIF if possible, restricting access to the cameras via VPN only, and considering device replacement due to the vendor's poor security track record. Since no patch is currently available, these network and access control measures are critical to reduce exposure. [2]