Dashboard / CVE-2025-65856

CVE-2025-65856

CRITICAL 2 PoCs
INFO Priority: 0.07 BB Relevance: 90/100
Published: 2025-12-22 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
xiongmaitech xm530v200_x6-weq_8m_firmware 5.00.r02.000807d8.10010.346624.s.onvif_21.06

References & Advisories (1)

Proof of Concept (2)

★ 3
https://github.com/LuisMirandaAcebedo/CVE-2025-65856
nomi-sec
★ 3
https://github.com/KostasEreksonas/XM_ONVIF_auth_bypass
nomi-sec

Bug Bounty Relevance

90 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (2)

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.74%
Raw Score 0.007450
Percentile 55.4%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00745
2026-11-13
0.00745
2026-11-12
0.00745
2026-11-10
0.00745
2026-11-09
0.00745
2026-11-08
0.00745
2026-11-07
0.00745
2026-11-06
0.00745
2026-11-05
0.00745
2026-11-04
0.00745

Intelligence Sources

nvd ref →

External Links