CVE-2025-65856

CRITICAL

9.8

Descripcion

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado12/22/2025

Ultima modificacion1/5/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

xiongmaitech:xm530v200_x6-weq_8mxiongmaitech:xm530v200_x6-weq_8m_firmware

Debilidades (CWE)

CWE-306

Referencias

http://hangzhou.com(cve@mitre.org)

http://ip.com(cve@mitre.org)

https://luismirandaacebedo.github.io/CVE-2025-65856/(cve@mitre.org)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.