exploitDog

CVE-2025-65856

Опубликовано: 22 дек. 2025

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Ссылки

http://hangzhou.com
Not Applicable
http://ip.com
Not Applicable
https://luismirandaacebedo.github.io/CVE-2025-65856/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:xiongmaitech:xm530v200_x6-weq_8m_firmware:5.00.r02.000807d8.10010.346624.s.onvif_21.06:*:*:*:*:*:*:*

cpe:2.3:h:xiongmaitech:xm530v200_x6-weq_8m:-:*:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.01856

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-306

Связанные уязвимости

GHSA-rq32-m8jv-7mjg

CVSS3: 9.8

github

около 1 месяца назад

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

EPSS

Процентиль: 83%

0.01856

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-306