CVE-2026-79394
Low risk· EPSS 13%Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.
Risk Assessment
Unauthorized parties can eavesdrop on the camera's video and audio streams, causing a serious confidentiality and privacy breach.
Recommendation
Enable RTSP authentication, update firmware to a patched version, and restrict network access to RTSP ports.
Other vulnerabilities in Xiongmai IP Camera XM530
Original NVD description (English source)
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.