Xiongmai IP camera flaw lets attackers bypass authentication and access devices remotely

A critical vulnerability in Hangzhou Xiongmai’s XM530 IP cameras can let attackers bypass authentication and gain remote access to sensitive functions without valid credentials. The flaw is tracked as CVE-2025-65856, and CISA published industrial control systems advisory ICSA-26-113-05 on April 23, 2026.

The issue affects Xiongmai XM530 IP cameras running firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. GitHub’s advisory database, which mirrors NVD data here, describes the bug as an authentication bypass in the camera’s ONVIF implementation.

BEST SPRING 2026 DEALS

Editor's Choice

Private Internet Access

Access content across the globe at the highest speed rate.

70% of our readers choose Private Internet Access

70% of our readers choose ExpressVPN

ExpressVPN

Browse the web from multiple devices with industry-standard security protocols.

Nord VPN

Faster dedicated servers for specific actions (currently at summer discounts)

The impact is serious because the vulnerable ONVIF service reportedly fails to enforce authentication on 31 critical endpoints. That can expose live video streams, device information, network settings, and other administrative data to an unauthenticated remote attacker. The flaw carries a CVSS 3.1 score of 9.8, which places it in the critical range.

What the vulnerability does

According to the public technical writeup from researcher Luis Miranda Acebedo, the camera accepts unauthenticated SOAP requests on ONVIF endpoints that should require WS-Security authentication. The researcher says that standard ONVIF authentication can be bypassed entirely because the device does not validate those security headers correctly.

The exposed endpoints include functions such as GetDeviceInformation, GetUsers, GetStreamUri, GetSnapshotUri, GetNetworkInterfaces, and GetNetworkProtocols. In practice, that means an attacker may be able to pull hardware and firmware details, enumerate users, retrieve stream locations, and inspect network settings without logging in first.

The researcher also says the flaw can expose relay and PTZ-related functions on some devices, which raises the risk beyond passive spying. In the worst case, a remotely reachable camera could become both a surveillance target and a foothold for wider internal network reconnaissance.

Why this is a bigger problem than one camera model

Xiongmai is a major OEM supplier whose hardware is often sold under many different brand names. The researcher specifically notes ANBIUX as one commercial brand and says the XM530 platform is widely rebranded, which means the same vulnerable base hardware may appear in different products and listings.

That is one reason flaws in low-cost IP cameras often linger. Security teams may not realize they are running the same underlying firmware because the device label on the box differs from the actual OEM platform inside it.

There is also a practical response problem. GitHub’s advisory page lists patched versions as unknown, and the researcher’s public writeup says no patch is currently available and that vendor contact attempts did not receive a response.

At a glance

Source basis: CISA advisory listing, GitHub Advisory Database, and the researcher’s public technical repository.

What organizations should do now

• Remove affected cameras from direct internet exposure. The researcher recommends isolated VLANs, strict firewall rules, and VPN-only remote access.
• Block inbound access to ports commonly used by the device, including 80, 8000, 8080, 8899, and 554, unless access is strictly required.
• Check whether ONVIF can be disabled on the device and turn it off if your deployment does not need it.
• Treat rebranded XM530-based cameras as potentially affected until you confirm the exact hardware and firmware. The public writeup says the issue likely affects V5.00.R02.* builds beyond the one tested version.
• Consider replacing exposed or unpatchable units in sensitive environments. The researcher explicitly recommends replacement if a secure update path is not available.

FAQ