EUVD-2026-76192
GHSA-53gc-rc5q-fprh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated SOAP request with no user interaction yields full control; the empty-password precondition is a deployment state, not attacker-side complexity, so AC stays L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream URL retrieval, and system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.
AnalysisAI
Authentication bypass in the Xiongmai XM530 IP camera firmware (HMT.CM2005-v220608.1837 and earlier) lets remote unauthenticated attackers execute privileged ONVIF actions - PTZ control, RTSP/stream URL retrieval, and system reboot - by sending a crafted SOAP request supplying the admin username with any arbitrary password whenever the account's stored password is empty. The flaw sits in the WS-Security (wsse:UsernameToken) verification routine of the Sofia IPC daemon, which fails to reject a token when no password is set. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted account's (admin) stored password is EMPTY - the WS-Security UsernameToken routine only accepts an arbitrary password in that state; a device with any admin password set is not vulnerable via this path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a trivially remote, unauthenticated, high-impact flaw, which is directionally accurate for a network-exposed camera. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched firmware version is identified in the available data, so apply compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Xiongmai XM530 cameras running firmware HMT.CM2005-v220608.1837 or earlier and isolate them on a restricted network segment with no direct internet access; apply network access controls limiting ONVIF/RTSP traffic to authorized endpoints only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today