CVE-2025-65856 | Authentication bypass vulnerability in Xiongmai XM530 IP cam… | CVSS 9.8 CRITICAL

Description

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Metadata

CVE ID: CVE-2025-65856
State: PUBLISHED
Assigner: mitre
Reserved: 2025-11-18 00:00 UTC
Published: 2025-12-22 00:00 UTC
Last updated: 2026-07-05 16:12 UTC
Primary CWE: CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-306	adp	CWE-306 Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://luismirandaacebedo.github.io/CVE-2025-65856/