PT-2025-52721 · Xiongmai · Xiongmai Xm530 Ip Cameras

Luis Miranda Acebedo · Published 2025-12-22 · Updated 2026-05-07 · CVE-2025-65857

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xiongmai XM530 IP cameras version V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06

Description The GetStreamUri function exposes RTSP URIs that include hardcoded credentials, allowing unauthorized access to direct video streams. The affected device is an IP camera.

Recommendations Update to a newer firmware version that addresses this issue. As a temporary workaround, restrict network access to the camera to trusted networks only.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2025-65857

Affected Products

Xiongmai Xm530 Ip Cameras

References · 9

• 🔥 https://luismirandaacebedo.github.io/CVE-2025-65857 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65857 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65857 · Vendor Advisory
• https://twitter.com/CVEnew/status/2003233966850265180 · Twitter Post
• http://ip.com · Note
• https://xiongmaitech.com/en/index.php/service/notice_info/51/4 · Note
• http://hangzhou.com · Note
• https://t.me/cveNotify/162619 · Telegram Post
• https://t.me/CVEtracker/40453 · Telegram Post