CVE-2025-65857

HighCVSS 7.5

Published: 22/12/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06, where the GetStreamUri function exposes RTSP URIs containing hardcoded credentials. This enables direct unauthorized access to the video stream.

Risk Assessment

The organization is at risk of unauthorized viewing of camera video streams, potentially leading to privacy breaches, industrial espionage, or loss of confidential visual information.

Recommendation

Immediately update the camera firmware to the latest version if a patch is available, or implement additional network security measures such as blocking unauthorized RTSP access at the firewall level.

Other vulnerabilities in Xiongmai XM530 IP cameras

CVE-2025-65856Critical
An authentication bypass vulnerability in Xiongmai XM530 IP cameras running Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Original NVD description (English source)

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.