Authentication Bypass in Xiongmai XM530 Cameras Enables Unauthorized Video Access

Executive Summary

CVE-2025-65856 is a critical authentication bypass vulnerability in the ONVIF implementation of Xiongmai XM530-series IP cameras. It allows unauthenticated remote attackers to access 31 critical ONVIF web service endpoints without any credentials. This happens because the ONVIF SOAP endpoints do not enforce WS-Security authentication and fail to validate security headers, enabling attackers to retrieve sensitive device information, configuration details, live video and audio streams, and control certain device functions. [2]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized access to live video and audio streams, full disclosure of device configuration, user account enumeration, PTZ (pan-tilt-zoom) control, relay output manipulation such as alarms, network reconnaissance, and extraction of RTSP credentials. This poses severe privacy risks including mass surveillance and unauthorized monitoring of sensitive environments. [2]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability poses severe privacy risks that violate GDPR requirements by enabling unauthorized access to personal data through live video and audio streams, potentially leading to mass surveillance and data breaches. Such unauthorized access compromises the confidentiality and integrity of personal information, thereby affecting compliance with privacy regulations like GDPR. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending unauthenticated SOAP requests to the ONVIF device service endpoints and checking if sensitive device information is returned without credentials. Devices vulnerable to this issue can be identified by scanning for specific server headers such as "uc-httpd" on port 80 or "XM" on port 8899. Tools like Shodan can be used to find exposed devices. Specific commands would involve crafting SOAP requests to endpoints like GetDeviceInformation or GetStreamUri on ports 80, 8000, 8080, or 8899 and observing the responses for authentication bypass. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include isolating the affected cameras on VLANs without internet access, blocking inbound traffic on the affected ports (80, 8000, 8080, 8899, 554), disabling ONVIF if possible, restricting access to the cameras via VPN only, and considering device replacement due to the vendor's poor security track record. Since no patch is currently available, these network and access control measures are critical to reduce exposure. [2]

Useful 0 Not Useful 0