Critical authentication bypass vulnerability (CVE-2025-65856) in Hangzhou Xiongmai Technology XM530 IP cameras allows unauthenticated remote attackers to access sensitive device information and live video streams. The vulnerability affects firmware V5.00.R02.000807D8.10010.346624.S.ONVIF_21.06 where the ONVIF implementation fails to enforce authentication on 31 critical endpoints. CVSS score of 9.8 (Critical). Vendor has not responded to CISA requests for mitigation. Proof of concept is publicly available. Devices are deployed worldwide in commercial facilities.