CVE-2025-65856

CRITICAL

9.8

Description

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/22/2025

Derniere modification1/5/2026

Sourcenvd

Observations honeypot0

Produits affectes

xiongmaitech:xm530v200_x6-weq_8mxiongmaitech:xm530v200_x6-weq_8m_firmware

Faiblesses (CWE)

CWE-306

References

http://hangzhou.com(cve@mitre.org)

http://ip.com(cve@mitre.org)

https://luismirandaacebedo.github.io/CVE-2025-65856/(cve@mitre.org)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.