CVE-2025-65856 Auth bypass in n/a
Unauthenticated attackers can access sensitive device information and live video streams due to missing authentication on ONVIF endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65856?
CVE-2025-65856 is a critical authentication bypass vulnerability in n/a, published on 22 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.
Weakness: CWE-306
Which versions are affected by CVE-2025-65856?
It affects 1 product.
Products include Xiongmaitech Xm530v200 X6-Weq 8m Firmware.
How do I fix CVE-2025-65856?
No fix has been published for CVE-2025-65856 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-65856 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65856 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rq32-m8jv-7mjg.