CVE-2026-79393 Xiongmai CVE debrief

Who should care

Defenders responsible for Xiongmai IP Camera XM530 firmware deployments should assess exposure and prioritize remediation. This vulnerability may impact organizations using affected firmware versions.

Why it matters

CVE-2026-79393 is a heap-based buffer overflow vulnerability in Xiongmai IP Camera XM530 firmware that may allow remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code. Defenders should prioritize verifying exposure and applying remediation.

• Potential denial of service via crafted SOAP requests
• Potential arbitrary code execution via crafted SOAP requests
• Verification of exposure and remediation priority for Xiongmai IP Camera XM530 firmware deployments

Technical summary

The vulnerability exists in the WS-Addressing Action transformation function in the Sofia IPC daemon of Xiongmai IP Camera XM530 firmware versions HMT.CM2005-v220608.1837 and earlier. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes, potentially leading to a denial of service or arbitrary code execution.

Defensive priority

Defenders should prioritize verifying exposure of Xiongmai IP Camera XM530 firmware versions HMT.CM2005-v220608.1837 and earlier, and applying vendor remediation if available.

Recommended defensive actions

• Verify exposure of Xiongmai IP Camera XM530 firmware versions HMT.CM2005-v220608.1837 and earlier
• Apply vendor remediation if available
• Monitor for crafted SOAP requests containing wsa5:Action strings exceeding 128 bytes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed versions beyond HMT.CM2005-v220608.1837 and earlier. The source reference provides additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.