Xiongmai XM530 CVE-2025-65856

Exploitation requires network reachability to the camera's ONVIF service (the SOAP/ONVIF listener, typically the device's HTTP/ONVIF port) on the specific vulnerable firmware V5.00.R02.000807D8.10010.346624.S / ONVIF 21.06 XM530V200 X6-WEQ build; no username, password, token, or user interaction is needed because authentication is entirely absent on the 31 affected endpoints. The practical limiting factor is exposure: the attacker must be able to route to the ONVIF port, so units behind NAT, on segmented VLANs, or firewalled from untrusted networks are not remotely exploitable, and devices on other firmware/hardware revisions may not be affected.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a trivially exploitable, network-reachable, unauthenticated flaw, and the missing-auth root cause is consistent with that ease of exploitation. However, the signals are mixed: EPSS is only 0.85% (54th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active mass exploitation despite the availability of public POC code. The documented impact is primarily information/stream disclosure (confidentiality), so the input's I:H/A:H rating may overstate integrity and availability effects unless the exposed ONVIF endpoints also permit configuration changes or PTZ control - this should be verified against the vendor's endpoint list. Net: a genuine and easy-to-exploit privacy/confidentiality exposure for any internet-facing unit, but the real-world blast radius depends heavily on how many of these specific-firmware cameras are exposed to untrusted networks rather than sitting behind NAT/VLAN segmentation.

An attacker scans for internet-exposed ONVIF/RTSP services, finds a vulnerable XM530 camera, and sends ONVIF SOAP requests to the unauthenticated endpoints to enumerate device details and obtain the media stream URI. They then connect to the live video feed with no credentials, gaining persistent covert surveillance of the monitored location. Public exploit code for this exact CVE lowers the skill barrier to near-trivial given the AV:N/AC:L/PR:N/UI:N profile.