CVE-2025-65856 Details

An authentication bypass vulnerability has been identified in Xiongmai XM530 IP cameras running ONVIF firmware version V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. This vulnerability allows unauthenticated remote attackers to access sensitive device information and live video streams. The issue arises because the ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized access to video streams and other sensitive data.

Users are advised to isolate the cameras on a separate VLAN without internet access, block inbound connections to common ports used by the cameras, disable the ONVIF protocol if possible, and avoid exposing the cameras directly to the internet. Given the vendor's poor security history, replacement of the cameras is recommended. The vendor should implement proper WS-Security authentication on all ONVIF endpoints, follow ONVIF Core Specification security requirements, add rate limiting and brute force protection, and enable security logging and alerts. However, no patch is currently available.