CVE-2026-79395 Xiongmai CVE debrief

Who should care

Defenders responsible for Xiongmai IP Camera XM530 firmware deployments should assess exposure and prioritize patching. Roles include security teams, network administrators, and IoT device managers.

Why it matters

CVE-2026-79395 is a critical vulnerability in Xiongmai IP Camera XM530 firmware that allows remote attackers to bypass authentication and execute privileged ONVIF actions. Defenders should prioritize verifying and patching affected firmware versions to prevent exploitation.

• Remote attackers can bypass authentication and execute privileged ONVIF actions, including PTZ control, stream URL retrieval, and system reboot.
• Defenders need to verify and patch affected firmware versions to prevent exploitation.
• Exposure to this vulnerability may allow unauthorized access to sensitive data or disruption of critical infrastructure.

Technical summary

The Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier has an improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine. A crafted SOAP request can bypass authentication when the account's stored password is empty, allowing execution of privileged ONVIF actions. The vulnerability has a CVSS score of 9.8 and is considered critical. Defenders should prioritize verifying and patching affected firmware versions to prevent exploitation. The affected firmware version is HMT.CM2005-v220608.1837 and earlier.

Defensive priority

Defenders should prioritize verifying and patching Xiongmai IP Camera XM530 firmware versions HMT.CM2005-v220608.1837 and earlier, as an improper authentication vulnerability allows remote attackers to bypass authentication and execute privileged ONVIF actions.

Recommended defensive actions

• Verify and patch Xiongmai IP Camera XM530 firmware versions HMT.CM2005-v220608.1837 and earlier.
• Restrict access to ONVIF actions and monitor for suspicious activity.
• Implement additional authentication mechanisms for ONVIF actions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the improper authentication vulnerability in Xiongmai IP Camera XM530 firmware. A crafted SOAP request can bypass authentication when the account's stored password is empty.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.