CVE-2025-65856

CRITICAL

9.8

Descricao

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado12/22/2025

Ultima modificacao1/5/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

xiongmaitech:xm530v200_x6-weq_8mxiongmaitech:xm530v200_x6-weq_8m_firmware

Fraquezas (CWE)

CWE-306

Referencias

http://hangzhou.com(cve@mitre.org)

http://ip.com(cve@mitre.org)

https://luismirandaacebedo.github.io/CVE-2025-65856/(cve@mitre.org)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.