Xiongmaitech

CVE-2025-65857 Dec 22, 22:16 HIGH POC This Week

GetStreamUri ONVIF endpoint in Xiongmai XM530 IP cameras exposes RTSP video streams with hardcoded credentials, allowing remote unauthenticated attackers to view live camera feeds without authentication. Affects firmware version V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. Publicly available exploit code exists demonstrating credential extraction and direct stream access. EPSS data not available, but the combination of network-accessible attack vector (AV:N), no authentication requirement (PR:N), and public POC creates immediate risk for exposed internet-facing cameras.

CVE-2025-65856 Dec 22, 22:16 CRITICAL POC Act Now

Unauthenticated access to live video and device data affects Xiongmai XM530-based IP cameras running firmware V5.00.R02.000807D8.10010.346624.S with ONVIF 21.06, where the ONVIF service fails to enforce authentication on 31 endpoints. Any remote attacker who can reach the camera's ONVIF port can pull sensitive device information and view real-time RTSP/ONVIF video streams without credentials. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and EPSS is modest (0.85%, 54th percentile).

CVE-2023-39068 Sep 11, 19:15 HIGH This Week

Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-45045 Dec 01, 05:15 HIGH POC This Week

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-26259 Mar 28, 01:15 HIGH POC This Week

A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-R-MH-V3, AHB80N16T-GS, AHB80N32F4-LME, and NBD90S0VT-QW. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-11878 May 10, 15:29 MEDIUM POC This Month

An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-17919 Oct 10, 15:29 MEDIUM This Month

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2018-17917 Oct 10, 15:29 MEDIUM This Month

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2018-17915 Oct 10, 15:29 CRITICAL Act Now

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2018-10088 Jun 08, 12:29 CRITICAL POC THREAT Act Now

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2017-16725 Dec 20, 19:29 CRITICAL Act Now

A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2017-7577 Apr 07, 04:59 CRITICAL POC Act Now

XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.