CRITICAL 9.8 NVD

CVE-2026-79395

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 fi

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream URL retrieval, and system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.

References

https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79395

Published: 2026-09-11 · Source: NVD · Feed updated: 2026-09-11

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-09-11 via NVD.

Risk Timeline

CVE Disclosed2026-09-11 · -1 days ago

Remediation Resources

GitHub

github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-7939

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.