Xiongmai XM530 IP Camera CVE-2025-65857

ONVIF service must be enabled and network-accessible on the camera - this is typically the default configuration for Xiongmai XM530 devices to support ONVIF Profile S compliance and third-party VMS integration. The GetStreamUri endpoint is part of the standard ONVIF Media service specification and is exposed whenever ONVIF is active. No special configuration, non-default settings, or optional features are required. Exploitation succeeds against default factory configurations with network reachability to ONVIF ports (commonly TCP 80, 8080, or 443 for ONVIF services). The only limiting factor is network accessibility - cameras deployed behind NAT without port forwarding or on isolated VLANs without internet routing are protected by network topology rather than device security controls.

Real-world risk is HIGH despite moderate 7.5 CVSS score. The CVSS vector confirms worst-case accessibility: network-based attack (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), resulting in high confidentiality impact (C:H). Public exploit code eliminates technical barriers to exploitation. The vulnerability is fully automatable - attackers can scan for exposed cameras and immediately extract streams. While not listed in CISA KEV (suggesting no confirmed widespread campaigns), the authentication bypass combined with POC availability means any internet-exposed XM530 camera is trivially compromised. Primary risk is privacy violation through unauthorized surveillance access. Integrity and availability are unaffected (I:N/A:N), limiting impact to confidentiality breach. Organizations using these cameras on public networks face immediate exposure; air-gapped or VLAN-isolated deployments significantly reduce risk.

Attacker performs Shodan or Censys scan identifying internet-exposed Xiongmai XM530 cameras on standard ONVIF ports (80/443/8080). Using the publicly available POC, attacker sends unauthenticated GetStreamUri request to the camera's ONVIF endpoint, which returns RTSP URI containing embedded username and password. Attacker extracts credentials from URI and connects directly to RTSP stream using VLC or similar player, gaining real-time video access without appearing in camera access logs as authenticated user. Entire attack completes in under 60 seconds with zero technical sophistication required.