Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera
CISA alerts critical authentication bypass in Xiongmai XM530 IP cameras affecting worldwide deployments.
Summary
CISA published an advisory (ICSA-26-113-05) for a critical authentication bypass vulnerability (CVE-2025-65856, CVSS 9.8) in Hangzhou Xiongmai Technology's XM530 IP cameras running firmware V5.00.R02.000807D8.10010.346624.S.ONVIF_21.06. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, allowing unauthenticated remote attackers to access sensitive device information and live video streams. Xiongmai has not responded to CISA's mitigation requests, and a public proof-of-concept exists; CISA recommends network isolation, firewall protection, and VPN use for remote access.
Full text
ICS Advisory Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera Release DateApril 23, 2026 Alert CodeICSA-26-113-05 Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to bypass authentication and have remote access to sensitive information on the device. The following versions of Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera are affected: IP Camera XM530V200_X6-WEQ_8M firmware V5.00.R02.000807D8.10010.346624.S.ONVIF_21.06 (CVE-2025-65856) CVSS Vendor Equipment Vulnerabilities v3 9.8 Hangzhou Xiongmai Technology Co., Ltd Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2025-65856 Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access. View CVE Details Affected Products Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera Vendor:Hangzhou Xiongmai Technology Co., Ltd Product Version:Hangzhou Xiongmai Technology Co., Ltd IP Camera XM530V200_X6-WEQ_8M firmware: V5.00.R02.000807D8.10010.346624.S.ONVIF_21.06 Product Status:known_affected Remediations MitigationHangzhou Xiongmai Technology Co., Ltd has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of XM530 IP cameras are invited to contact Xiongmai Technology customer support for additional information (https://www.xiongmaitech.com/en/index.php/about/contact/42).https://www.xiongmaitech.com/en/index.php/about/contact/42 Relevant CWE: CWE-306 Missing Authentication for Critical Function Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Acknowledgments CISA discovered a public Proof of Concept (PoC) as authored by Luis Miranda Acebedo and reported it to MITRE Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Revision History Initial Release Date: 2026-04-23 Date Revision Summary 2026-04-23 1 Initial Publication Legal Notice and Terms of Use This product is provided subject to this Notification and this Privacy & Use policy. Vendor Hangzhou Xiongmai Technology Co., Ltd Tags Sector: Commercial Facilities Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Please share your thoughts We recently updated our anonymous product survey; we welcome your feedback. Related Advisories Apr 23, 2026 ICS Advisory | ICSA-26-113-06 Intrado 911 Emergency Gateway (EGW) Apr 23, 2026 ICS Advisory | ICSA-26-113-04 SpiceJet Online Booking System Apr 23, 2026 ICS Advisory | ICSA-26-113-02 Carlson Software VASCO-B GNSS Receiver Apr 23, 2026 ICS Advisory | ICSA-26-113-01 Yadea T5 Electric Bicycle
Indicators of Compromise
- cve — CVE-2025-65856
- malware — Xiongmai XM530 firmware V5.00.R02.000807D8.10010.346624.S.ONVIF_21.06