Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera

Published:

23 april 2026 om 12:00:00

Alert date:

23 april 2026 om 17:04:31

Source:

cisa.gov

Mobile & IoT, Critical Infrastructure

Critical authentication bypass vulnerability (CVE-2025-65856) in Hangzhou Xiongmai Technology XM530 IP cameras allows unauthenticated remote attackers to access sensitive device information and live video streams. The vulnerability affects firmware V5.00.R02.000807D8.10010.346624.S.ONVIF_21.06 where the ONVIF implementation fails to enforce authentication on 31 critical endpoints. CVSS score of 9.8 (Critical). Vendor has not responded to CISA requests for mitigation. Proof of concept is publicly available. Devices are deployed worldwide in commercial facilities.

Technical details

Mitigation steps:

Affected products:

Hangzhou Xiongmai Technology XM530 IP Camera