CVE-2026-79394 Xiongmai CVE debrief

Who should care

Defenders responsible for Xiongmai IP Camera XM530 deployments, particularly those using firmware HMT.CM2005-v220608.1837 and earlier, should assess exposure and prioritize mitigation to prevent unauthorized access to video and audio feeds.

Why it matters

CVE-2026-79394 is a high-severity vulnerability in Xiongmai IP Camera XM530 firmware that allows remote unauthenticated access to live video and audio feeds. Defenders should prioritize verifying and mitigating exposure to prevent potential unauthorized access and information disclosure.

• Potential unauthorized access to sensitive video and audio feeds.
• Possible exposure of sensitive information through unencrypted RTP/UDP streams.
• Need for verification of current firmware versions and configurations.
• Priority for updating firmware to enable authentication for the Happytime RTSP server.

Technical summary

The Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains an insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon. This configuration ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP. The vulnerability allows for potential unauthorized access to sensitive video and audio feeds and possible exposure of sensitive information through unencrypted RTP/UDP streams. Defenders should prioritize verifying and mitigating exposure to prevent potential unauthorized access and information disclosure.

Defensive priority

Defenders should prioritize verifying and mitigating exposure to unencrypted video and audio feeds from Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier.

Recommended defensive actions

• Verify and update Xiongmai IP Camera XM530 firmware to a version that enables authentication for the Happytime RTSP server.
• Implement compensating controls, such as encrypting video and audio feeds, to protect against unauthorized access.
• Monitor for and respond to potential unauthorized access to video and audio feeds.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description and NVD entry provide details on an insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.