An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.
CVE-2025-65857
CVSS base score
7.5 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-359
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
xiongmaitech xm530v200 x6-weq 8m firmware
References
- luismirandaacebedo.github.io Exploit, Mitigation, Third Party Advisory
- www.xiongmaitech.com