the WS-Security (wsse:UsernameToken) verification routine within has a security flaw

Published September 11, 2026 CVE-2026-79395

Some Xiongmai XM530 security cameras will let a remote attacker log in as the admin account using any password at all, then take over the camera. That includes watching the live video feed, moving it with pan-tilt-zoom, and forcing a reboot.

Severity
CriticalCVSS 3.1 · 9.8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Fix
Not confirmedLast checked today
Weakness
CWE-287Improper Authentication
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-76192ENISA vulnerability database

How it works

  • The camera's ONVIF remote-control service checks logins by looking up the admin account's stored password before comparing it to what the sender typed.
  • When that stored password is blank, the check skips the comparison entirely and approves the login anyway.
  • Xiongmai XM530 cameras ship with the admin account's password blank by default, so this applies right out of the box.
  • An attacker only needs network access to the camera and the username admin; any password value is accepted.
  • Once inside, the attacker gets the same remote-control powers as a real admin, including moving the camera and rebooting it.

What to do

Check whether your camera is a Xiongmai XM530 or a rebadged camera built on the same Sofia/ONVIF software. Compare its firmware version against HMT.CM2005-v220608.1837; that build and earlier are described as affected. Check whether the camera's admin account still has no password set, since the flaw only lets any password through when the stored password is empty. Check whether the camera's ONVIF service is reachable from the internet or from an untrusted part of your network, since the bypass works over that connection.

Log into the camera's admin settings and set a real, non-blank password on the admin account if one is not already set. Contact the camera's seller or Xiongmai OEM brand for a firmware update, since no fix has been confirmed as released at this time. Keep the camera off the open internet and behind a router or firewall so its ONVIF service is not reachable from outside your network.

Technical details

The flaw is in the WS-Security username and password check inside the Sofia daemon's ONVIF device service. When a client sends a login request, the code looks up the account's stored password; if that stored value is empty, the check returns success immediately instead of validating the password digest the client sent. Because the admin account ships with an empty stored password, any supplied password authenticates as admin. This authorizes PTZ move and preset actions and a system reboot action over a single request to the device's ONVIF endpoint.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source