CVE-2025-65856

CRITICAL

9.8

Description

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/22/2025

Last Modified1/5/2026

Sourcenvd

Honeypot Sightings0

Affected Products

xiongmaitech:xm530v200_x6-weq_8mxiongmaitech:xm530v200_x6-weq_8m_firmware

Weaknesses (CWE)

CWE-306

References

http://hangzhou.com(cve@mitre.org)

http://ip.com(cve@mitre.org)

https://luismirandaacebedo.github.io/CVE-2025-65856/(cve@mitre.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.