EUVD-2026-76189
GHSA-9xx2-xxg3-9xpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Xiongmai XM530 camera
-
ExploitRetrieve hardcoded credentials from firmware/Sofia binary
-
ExecutionAuthenticate remotely with static admin account
-
ImpactGain full administrative control of device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation using static, firmware-embedded default credentials against Xiongmai XM530 cameras running HMT.CM2005-v220608.1837 or earlier. The practical limiting factor is exposure and version: the device must be network-reachable by the attacker (internet-facing or on an accessible LAN) and running the affected firmware; devices isolated behind NAT/firewalls or already updated are not exploitable. The credentials are identical across devices, so exploitation scales trivially once the credentials are known. |
| Impact | The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case profile for CWE-798: static, plaintext credentials baked into firmware (bin/config.xml and the Sofia binary) grant remote, unauthenticated, full administrative takeover with no user interaction. This is consistent with the description and I concur with the vector. Countervailing signals temper urgency somewhat: EPSS is only 0.18% (8th percentile), there is no CISA KEV listing, and no vendor-confirmed active exploitation. No SSVC decision data is provided. This is a genuinely high-severity, low-friction flaw whose technical impact is total, but there is no evidence of widespread automated exploitation yet - a posture typical of embedded/IoT credential issues that are trivially exploitable once known but not necessarily mass-scanned under this specific CVE. Note that hardcoded credentials in Xiongmai-family devices have historically been abused by IoT botnets (e.g., Mirai-class), so real-world risk should be treated as materially higher than EPSS alone implies wherever these cameras are internet-exposed. A referenced third-party research repository (ShiroiBoushi/vulnerability-research) likely contains technical detail and possibly proof-of-concept material, but no POC flag is set in the input, so exploit availability is not confirmed here. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed Xiongmai XM530 camera (running HMT.CM2005-v220608.1837 or earlier), extracts the static admin credentials that are publicly documented from the firmware's bin/config.xml or the Sofia executable, and logs in remotely to gain full administrative control - viewing/manipulating the video feed, altering configuration, or enrolling the device into a botnet. No authentication material specific to the target and no user interaction are required. A third-party research repository is referenced and may contain proof-of-concept detail, though POC availability is not confirmed in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Xiongmai XM530 IP cameras running firmware HMT.CM2005-v220608.1837 or earlier ship with static, hardcoded administrative credentials that are stored in cleartext in bin/config.xml and compiled directly into the Sofia executable, so any remote attacker who can reach the device can log in with the same known username/password pair and obtain full administrative control. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the attack is network-reachable, unauthenticated and requires no user interaction, and because the credential set is identical across units, exploitation scales trivially against any exposed camera. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), although that score understates the risk for internet-facing devices given that the only real prerequisites are network reachability and unpatched firmware.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must begin with compensating controls. Immediately change every administrative and service account password on the camera from the firmware default and then verify the change survives a reboot (the credentials are compiled into the Sofia binary, so a factory reset or firmware-side default restore may silently revert them - treat any post-reboot reversion as confirmation the device is unpatchable). Remove the cameras from direct internet exposure: block inbound access to the web/management ports (typically 80/443/8080), RTSP 554 and the Xiongmai management/P2P ports (e.g. 34567) at the perimeter firewall, and disable UPnP and any cloud/P2P NAT-traversal feature, since these are the mechanisms that most often turn a LAN-only camera into an internet-reachable one; the trade-off is that P2P/UPnP disabling breaks mobile-app remote viewing and requires a VPN or reverse proxy instead. Place cameras on an isolated VLAN or dedicated SSID with no routing to user workstations or servers, and if remote access is genuinely required front it with a VPN or authenticated reverse proxy rather than port forwarding - this adds client software or a gateway appliance and some latency but eliminates the trivially-scannable attack surface. Finally, where changing credentials is impossible, restrict the management interface to a single trusted management IP or block it entirely (RTSP-only operation), accepting loss of web configuration and firmware management as the cost, and plan hardware replacement for units that cannot be secured. Monitor the linked research repository https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79396 and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-79396) for a vendor fix or firmware update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a textbook CWE-798 (Use of Hard-coded Credentials) defect in the Xiongmai XM530 embedded camera platform, whose firmware is identified as HMT.CM2005-v220608.1837 and earlier. The credentials are not merely a documented factory default that is generated per-device or forced to change on first boot; they are static values persisted as unencrypted plaintext in the filesystem at bin/config.xml and additionally compiled into the Sofia application binary, meaning the values can be recovered trivially from firmware images, extracted filesystems or strings output, and are shared across every device built from the same image. Because the credentials are baked into the application rather than stored in a per-unit secrets store, firmware updates are the only way to rotate them, and account configuration or password changes made through the web/management interface may not reliably override or persist against the compiled defaults. The affected stack is the Linux-based Xiongmai camera firmware with its web/ONVIF/RTSP management surface; per the supplied CPE data no usable CPE identifier was resolved (cpe:2.3:a:n/a:n/a), so version-based identification must be done through the firmware string HMT.CM2005-v220608.1837 rather than automated CPE matching. The EUVD entry EUVD-2026-76189 mirrors the same finding and carries an unpopulated version range, reinforcing that the disclosure is currently hand-curated rather than scanner-mapped.
Know when Hardcoded Credentials gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Static firmware-embedded credentials give any remote attacker unauthenticated admin control with no user interaction, yielding full confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera.
Executive ViewAI
Xiongmai XM530 IP cameras running firmware HMT.CM2005-v220608.1837 or earlier are exposed to full administrative takeover by unauthenticated remote attackers because they share static hardcoded credentials across all units. Any internet-reachable camera can be compromised at scale, potentially exposing video feeds, enabling persistent surveillance, and providing a foothold into the corporate network. Leadership should treat this as a high-priority exposure until the vendor provides a patch, especially for cameras deployed in sensitive or internet-facing locations.
No vendor-released patch identified at time of analysis. Interim mitigations: remove affected Xiongmai XM530 cameras from direct internet access; isolate them on a dedicated VLAN; restrict management to trusted internal networks or VPN; block inbound ports and disable UPnP and port forwarding; monitor for anomalous logins and outbound traffic; and replace or disable devices in high-risk locations until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Hardcoded Credentials
View allThe EVbee DC-80 firmware ships with a hardcoded root password, allowing unauthenticated remote attackers to log in via S
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetr
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SE
Exploit-DB