Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856)

Metadata

Affected Target

Summary

CVE-2025-65856 is a critical authentication bypass in the ONVIF implementation shipped on Xiongmai XM530-based IP cameras. The device’s device_service and media_service ONVIF SOAP endpoints accept and fully process requests such as GetDeviceInformation, GetCapabilities, GetProfiles, and GetStreamUri without requiring or validating any WS-Security UsernameToken / digest authentication, even though ONVIF’s specification mandates authenticated access to these operations. The root cause is that the camera’s ONVIF service does not enforce authentication on its SOAP handlers at all — any client that can reach the exposed port can query device metadata and obtain live RTSP stream URIs. The included PoCs (raw curl/SOAP shell scripts and a Python script built on the onvif library) demonstrate unauthenticated retrieval of device information, media profiles, and playable RTSP stream URIs, giving an unauthenticated network attacker full read access to the camera’s live video feed and device configuration.

Vulnerability Details

Root Cause

The camera’s ONVIF SOAP service does not enforce WS-Security authentication on privileged operations. The PoC’s shell scripts send raw, unauthenticated SOAP envelopes directly to the device service and media service endpoints and receive valid, fully-populated responses:

1
2
3
4
5
6
7
8

curl -s -X POST http://${1}:8899/onvif/device_service \
-H "Content-Type: application/soap+xml" \
-d '<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope">
<s:Body>
<GetDeviceInformation xmlns="http://www.onvif.org/ver10/device/wsdl"/>
</s:Body>
</s:Envelope>'

No wsse:Security / UsernameToken header, digest, or nonce is present anywhere in the request — the device responds with manufacturer, model, firmware, and serial number regardless. The Python PoC (xm_onvif_auth_bypass.py) shows the same behavior through the higher-level ONVIFCamera client: even when instantiated with a blank/arbitrary username and password, devicemgmt.GetDeviceInformation(), media.GetProfiles(), and media.GetStreamUri() all succeed, confirming the device does not actually validate credentials it advertises support for (CWE-306: Missing Authentication for Critical Function / CWE-287: Improper Authentication).

Attack Vector

1. Attacker identifies a Xiongmai XM530-based camera exposing ONVIF on TCP/8899 (directly reachable or port-forwarded to the internet).
2. Attacker sends an unauthenticated SOAP GetCapabilities / GetDeviceInformation request to /onvif/device_service, receiving full device metadata (manufacturer, model, firmware, serial number, hardware ID) with no credentials.
3. Attacker sends an unauthenticated SOAP GetProfiles request to /onvif/media_service, enumerating available media profile tokens (e.g. PROFILE_000, PROFILE_001) along with video/audio encoder configuration.
4. Attacker sends an unauthenticated GetStreamUri request with a discovered profile token, receiving a working RTSP stream URI.
5. Attacker connects to the returned RTSP URI to view the live video feed, with no authentication required at any step.

Impact

An unauthenticated attacker on the network path to the camera can fully enumerate device information and access live (and potentially recorded) video/audio streams, resulting in a complete loss of confidentiality for camera feeds and device configuration. Depending on ONVIF media/PTZ operations exposed by the same unauthenticated path, this could extend to camera reconfiguration (e.g. PTZ control) on affected deployments.

Environment / Lab Setup

Target: Xiongmai XM530-based IP camera
Model: XM530_50X50-WG_8M
Firmware version: V5.00.R02.00030747.10010.349f17
ONVIF service: HTTP, TCP/8899, endpoints /onvif/device_service and /onvif/media_service

Attacker tooling:
- Bash + curl + xmllint (Curl/ PoC)
- Python 3 with `onvif` library, managed via `uv` (Python/ PoC; see pyproject.toml / uv.lock)

Proof of Concept

PoC Script

See Curl/get_device_capabilities.sh, Curl/get_device_information.sh, Curl/get_device_profiles.sh, Curl/get_device_stream.sh, and Python/xm_onvif_auth_bypass.py in this folder.

1
2
3
4
5

./get_device_capabilities.sh <TARGET_IP>
./get_device_information.sh <TARGET_IP>
./get_device_profiles.sh <TARGET_IP>
./get_device_stream.sh <TARGET_IP> <PROFILE_TOKEN>
uv run xm_onvif_auth_bypass.py -i <TARGET_IP> -p 8899 -u admin -s ""

Detection & Indicators of Compromise

HTTP POST requests to /onvif/device_service and /onvif/media_service on TCP/8899
with SOAP bodies containing GetDeviceInformation, GetCapabilities, GetProfiles,
or GetStreamUri actions and NO wsse:Security / UsernameToken header present.

Signs of compromise:

• Unexpected/unknown source IPs issuing repeated ONVIF SOAP requests without authentication headers.
• RTSP connections originating shortly after GetStreamUri calls from unfamiliar clients.
• Camera device information (model/firmware/serial) appearing in external scan or recon tool output (e.g. Shodan/Censys) for devices that should be network-isolated.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/KostasEreksonas/XM_ONVIF_auth_bypass on 2026-07-06. Both the Bash/curl and Python PoCs are fully working against the tested XM530 firmware/model; test environment details (exact model and firmware string) are carried over from the source repository’s README.