Dashboard / CVE-2025-65857

CVE-2025-65857

HIGH 1 PoC
MEDIUM Priority: 0.03 BB Relevance: 85/100
Published: 2025-12-22 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: None

Description

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
xiongmaitech xm530v200_x6-weq_8m_firmware 5.00.r02.000807d8.10010.346624.s.onvif_21.06

References & Advisories (2)

https://luismirandaacebedo.github.io/CVE-2025-65857/
Exploit Mitigation Third Party Advisory

Proof of Concept (1)

★ 5
https://github.com/LuisMirandaAcebedo/CVE-2025-65857
nomi-sec

Bug Bounty Relevance

85 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.43%
Raw Score 0.004260
Percentile 37.4%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00426
2026-11-13
0.00426
2026-11-12
0.00426
2026-11-10
0.00426
2026-11-09
0.00426
2026-11-08
0.00426
2026-11-07
0.00426
2026-11-06
0.00426
2026-11-05
0.00426
2026-11-04
0.00426

Intelligence Sources

nvd ref →

External Links