CVE-2025-65856 Hangzhou Xiongmai Technology Co., Ltd CVE debrief

Who should care

Organizations using XM530-based Xiongmai IP cameras, especially teams responsible for physical security, surveillance, building operations, and network segmentation. Security teams should also care if these cameras are reachable from untrusted networks or exposed through ONVIF-enabled management paths.

Technical summary

CVE-2025-65856 affects Xiongmai XM530 IP cameras running firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The issue is an authentication bypass in the ONVIF implementation: authentication is not enforced on 31 critical endpoints. CISA describes the impact as unauthorized access to sensitive device information and live video streams. The advisory maps the issue to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, Critical).

Defensive priority

Immediate. Treat affected cameras as high-risk exposed devices and reduce access to ONVIF and management interfaces until the environment is verified and vendor guidance is applied.

Recommended defensive actions

• Inventory all Xiongmai XM530 camera deployments and confirm whether they run firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.
• Restrict network access to camera management and ONVIF services to trusted administrative hosts or segmented management networks only.
• If affected, contact Xiongmai Technology customer support for remediation guidance referenced by CISA and track any vendor-provided corrective actions.
• Review camera, NVR, and access logs for unusual requests to device information or video-stream endpoints.
• Segment surveillance devices from general user and internet-facing networks, and verify that remote exposure is not enabled unnecessarily.

Evidence notes

Source evidence comes from CISA’s CSAF advisory ICSA-26-113-05 and the associated CVE record, both published on 2026-04-23. The advisory text explicitly states: authentication bypass, 31 critical ONVIF endpoints without enforced authentication, sensitive device information exposure, and live video stream access. The source also notes that Hangzhou Xiongmai Technology Co., Ltd had not responded to mitigation requests at the time of publication. No KEV listing is indicated in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.