CVE-2025-65857

{
  "id": "CVE-2025-65857",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-22T22:16:08.530",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en cámaras IP Xiongmai XM530 en el firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. La función GetStreamUri expone URIs RTSP que contienen credenciales codificadas de forma rígida, lo que permite el acceso directo no autorizado al flujo de video."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-22T22:00:06.274789Z",
          "id": "CVE-2025-65857",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-359"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:xiongmaitech:xm530v200_x6-weq_8m_firmware:5.00.r02.000807d8.10010.346624.s.onvif_21.06:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DFBF9B8-CA55-459F-95F9-3606B52D92B7"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:xiongmaitech:xm530v200_x6-weq_8m:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D72FD0CF-CE0C-4466-8F42-099FA0E8D7D5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://luismirandaacebedo.github.io/CVE-2025-65857/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.xiongmaitech.com/en/index.php/service/notice_info/51/4",
      "source": "[email protected]"
    }
  ]
}