CVE-2025-65857
📋 TL;DR
This vulnerability in Xiongmai XM530 IP cameras exposes RTSP video streams through hardcoded credentials in the GetStreamUri function. Attackers can directly access live video feeds without authentication. Only Xiongmai XM530 cameras with specific vulnerable firmware are affected.
💻 Affected Systems
- Xiongmai XM530 IP Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete surveillance compromise allowing unauthorized real-time video monitoring, potential physical security breaches, and privacy violations.
Likely Case
Unauthorized access to live camera feeds enabling surveillance of private spaces and sensitive areas.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access.
🎯 Exploit Status
Exploitation requires only accessing the exposed RTSP URI with hardcoded credentials; trivial for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided in references
Restart Required: No
Instructions:
No official patch available. Contact Xiongmai for firmware updates or security advisories.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with strict firewall rules blocking external RTSP access.
Access Control Lists
allImplement IP-based restrictions allowing only authorized systems to access camera RTSP streams.
🧯 If You Can't Patch
- Physically disconnect cameras from internet-facing networks
- Replace affected cameras with secure alternatives from different vendors
🔍 How to Verify
Check if Vulnerable:
Attempt to access RTSP stream using hardcoded credentials via tools like VLC or ffmpeg: rtsp://[camera-ip]:554/stream1 with default credentialsCheck Version:
Check camera web interface or ONVIF device management for firmware versionVerify Fix Applied:
Verify RTSP stream access requires proper authentication and hardcoded credentials no longer work📡 Detection & Monitoring
Log Indicators:
- Unauthorized RTSP connection attempts
- Multiple failed authentication attempts to camera streams
Network Indicators:
- Unusual RTSP traffic patterns
- External IPs accessing internal camera streams
SIEM Query:
source_ip=external AND dest_port=554 AND protocol=RTSP