CVE-2026-79393
Received Received - Intake

Heap-based Buffer Overflow in Xiongmai IP Camera XM530 Firmware

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-79393
EUVD
EUVD-2026-76185

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xiongmai xm530 to HMT.CM2005-v220608.1837 (exc)
xiongmai sofia_ipc_daemon to HMT.CM2005-v220608.1837 (inc)
xiongmai sofia_ipc_daemon to HMT.CM2005-v210104.1124 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in the Sofia IPC daemon of Xiongmai IP cameras. The flaw occurs when processing WS-Addressing Action headers in SOAP requests. If the Action value contains 'Request' and exceeds 128 bytes, the daemon incorrectly rewrites it to 'Response' without checking length, causing heap corruption. This can lead to crashes or arbitrary code execution.

Detection Guidance

To detect this vulnerability, monitor network traffic for oversized SOAP requests with wsa5:Action headers exceeding 128 bytes. Use packet capture tools like tcpdump or Wireshark to inspect HTTP/HTTPS traffic for malformed SOAP/XML payloads targeting ONVIF services. Check for crashes or SIGSEGV errors in Sofia IPC daemon logs on affected devices.

  • Capture traffic: tcpdump -i any -w capture.pcap 'tcp port 80 or tcp port 443'
  • Analyze payloads: Wireshark filter for 'http contains "wsa5:Action"'
  • Check logs: grep -i 'SIGSEGV' /var/log/syslog or device-specific logs
Impact Analysis

An attacker could exploit this remotely without authentication by sending a crafted SOAP request. This may cause the device to crash (denial of service) or allow the attacker to run malicious code on the device. Since the Sofia daemon runs on IP cameras and DVR/NVR systems, it could compromise surveillance systems or network security.

Compliance Impact

This vulnerability could lead to unauthorized access or denial of service in IP camera systems, potentially compromising data integrity and availability. For GDPR, this may impact data protection obligations under Articles 32 (security of processing) and 5 (principles relating to processing). For HIPAA, it could affect the integrity and availability of protected health information if exploited in medical surveillance systems.

Mitigation Strategies

Immediately isolate affected devices from untrusted networks. Disable ONVIF services if not required. Apply firmware updates from Xiongmai if available. Block malformed SOAP requests at network perimeter using WAF or IDS rules targeting oversized wsa5:Action headers. Monitor for crashes or unusual activity.

  • Isolate devices: Remove from public internet or restrict access via firewall
  • Update firmware: Contact vendor for patched versions
  • Block traffic: Configure firewall to drop requests with wsa5:Action >128 bytes

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart