EUVD-2026-76192
GHSA-53gc-rc5q-fprh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover internet-exposed Xiongmai ONVIF service
-
DeliverySend crafted SOAP with admin UsernameToken and arbitrary password
-
ExploitBypass empty-password verification in Sofia daemon
-
ExecutionInvoke privileged ONVIF actions
-
ImpactRetrieve streams, control PTZ, or reboot device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the targeted account's (admin) stored password is EMPTY - the WS-Security UsernameToken routine only accepts an arbitrary password in that state; a device with any admin password set is not vulnerable via this path. The attacker must be able to reach the Sofia IPC daemon's ONVIF SOAP interface over the network (no authentication, no user interaction needed). Affected build is XM530 firmware HMT.CM2005-v220608.1837 or earlier. The empty-password precondition is the primary limiting factor and makes real-world exploitability dependent on the device's credential configuration rather than universal. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a trivially remote, unauthenticated, high-impact flaw, which is directionally accurate for a network-exposed camera. The critical nuance the score omits is the precondition: exploitation only works when the admin account's stored password is empty. On these low-cost OEM cameras a blank/default admin credential is a common shipping state, so the condition is frequently met in practice - but hardened deployments that set a password are not exploitable via this path, making real-world exposure config-dependent rather than universal. No EPSS score, KEV listing, or SSVC decision data was provided in the input. Publicly available exploit code exists (linked GitHub research repo), which raises practical risk, but POC availability is not the same as confirmed active exploitation - no KEV signal is present. Net: a genuine high priority for internet-exposed or default-credential Xiongmai cameras, with the empty-password requirement as the main limiting factor. |
| Exploit ScenarioDerived | An attacker scans for internet-exposed Xiongmai ONVIF services on a device still running with a blank admin password, then sends a crafted SOAP request carrying a wsse:UsernameToken with the admin username and an arbitrary password. The device accepts it as authenticated, letting the attacker pull live stream URLs, steer PTZ to survey a facility, and reboot the camera to cause an outage. Publicly available POC code lowers the skill barrier for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Authentication bypass in the Xiongmai XM530 IP camera firmware (HMT.CM2005-v220608.1837 and earlier) lets remote unauthenticated attackers execute privileged ONVIF actions - PTZ control, RTSP/stream URL retrieval, and system reboot - by sending a crafted SOAP request supplying the admin username with any arbitrary password whenever the account's stored password is empty. The flaw sits in the WS-Security (wsse:UsernameToken) verification routine of the Sofia IPC daemon, which fails to reject a token when no password is set. Publicly available exploit code exists (GitHub research repository); no public evidence of active in-the-wild exploitation at time of analysis.
RemediationAI
No vendor-released patched firmware version is identified in the available data, so apply compensating controls. The single most effective mitigation is to ensure the admin account has a non-empty password set, since the bypass only triggers on an empty stored password - verify and set a strong admin credential on every device. Remove these cameras from direct internet exposure and block inbound access to the ONVIF/SOAP and RTSP service ports at the network edge, permitting access only from a trusted management VLAN or via VPN (trade-off: remote mobile/app viewing must then be tunneled). Segment cameras onto an isolated network so a compromised device cannot pivot, and monitor for the vendor to publish updated firmware, tracking the referenced research repo (https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79395) for technical detail. Setting the admin password has no functional downside and should be treated as the immediate priority.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Sofia IPC daemon, the core media/control service used across Xiongmai (XM) SoC-based cameras and DVRs, exposing an ONVIF SOAP interface secured by the WS-Security UsernameToken profile. Under WS-Security, a client authenticates by supplying a username plus a password digest (or plaintext) inside the wsse:UsernameToken element. The root cause is CWE-287 (Improper Authentication): when the stored password for the admin account is empty, the verification routine treats any supplied password as valid rather than failing closed, so the token check is effectively skipped. The affected build is XM530-series firmware HMT.CM2005-v220608.1837 and earlier; the CPE in the feed is a non-informative placeholder (cpe:2.3:a:n/a:n/a:*), so exact product identity must be taken from the description rather than the structured CPE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated SOAP request with no user interaction yields full control; the empty-password precondition is a deployment state, not attacker-side complexity, so AC stays L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream URL retrieval, and system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.
Executive ViewAI
Xiongmai XM530 IP cameras are vulnerable to complete remote compromise without credentials, enabling attackers to control camera functions, redirect video streams, and force system reboots. Any organization deploying these cameras for surveillance, security monitoring, or access control faces immediate risk of camera hijacking, footage tampering, and operational disruption. This vulnerability affects cameras already deployed, with no vendor patch available to reduce risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) isolate affected cameras on dedicated network segment with no internet access; (2) implement strict IP whitelisting and firewall rules restricting ONVIF access to authorized management systems only; (3) disable ONVIF services if cameras can operate without remote management; (4) monitor network traffic for suspicious SOAP requests; (5) prioritize replacement with cameras from vendors offering confirmed security patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB