CVE-2026-79396 Details

A vulnerability exists in Xiongmai IP cameras running the Sofia IPC camera daemon, specifically in the firmware version HMT.CM2005-v220608.1837 and earlier. This vulnerability arises from hardcoded default credentials that are identical across all cameras in the product line. The credentials, 'admin' with password 'admin' and 'user' with password '123456', are stored in unencrypted plaintext within the root filesystem's config.xml file and are also embedded in the Sofia executable. This allows remote attackers to gain full administrative control over the cameras.

To address this vulnerability, it is recommended to implement unique credentials for each device at the time of provisioning, remove hardcoded credential seeding from the Sofia binary, hash stored passwords in the config.xml file, and ensure that authentication is enabled by default on all devices.