CVE-2025-65857

high

Description

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.

References

https://github.com/LuisMirandaAcebedo/CVE-2025-65856

https://github.com/LuisMirandaAcebedo/CVE-2025-65857

https://www.xiongmaitech.com/en/index.php/service/notice_info/51/4

https://luismirandaacebedo.github.io/CVE-2025-65857/

Details

Source: Mitre, NVD

Published: 2025-12-22

Updated: 2026-07-05

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N