CVE-2026-79394
Received Received - Intake

Insecure Default Configuration in Xiongmai IP Camera XM530 Firmware

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-79394
EUVD
EUVD-2026-76190

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xiongmai happytime_rtsp_server to HMT.CM2005-v220608.1837 (exc)
xiongmai xm530_firmware HMT.CM2005-v220608.1837
xiongmai sofia_ipc_daemon to HMT.CM2005-v220608.1837 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Xiongmai Sofia IPC daemon which embeds an RTSP server called Happytime RTSP server. The server has a default setting that disables authentication, allowing anyone on the network to access live video and audio feeds from affected IP cameras without needing credentials. The streams are sent unencrypted over RTP/UDP, making them vulnerable to eavesdropping.

Detection Guidance

To detect this vulnerability, scan your network for devices exposing TCP port 554. Use tools like nmap to check for open RTSP ports: nmap -p 554 <target-ip>. If the port is open, attempt to access the stream via rtsp://<ip>:554/streamtype=0 using a media player like VLC. If the stream plays without authentication, the device is likely vulnerable.

Impact Analysis

Unauthorized individuals could access your live video and audio feeds without your knowledge. Since the streams are unencrypted, attackers on the same network could intercept and view the content. This could lead to privacy breaches, surveillance, or misuse of sensitive footage.

Compliance Impact

This vulnerability likely violates privacy and data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive data. Unauthorized access to video and audio feeds could result in non-compliance, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately enable authentication on the RTSP server by setting need_auth=1 in the configuration. If no update is available, isolate affected devices from untrusted networks, block TCP port 554 at the firewall, and monitor for unauthorized access attempts. Consider replacing or updating the firmware if a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart