CVE-2026-79394 in Sofia IPC daemon
Summary
by MITRE • 09/11/2026
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified involves a critical misconfiguration within the embedded Happytime RTSP server component of the Sofia IPC daemon found in Xiongmai IP Camera models, specifically firmware version HMT.CM2005-v220608.1837 and earlier releases. This flaw stems from an insecure default configuration where authentication mechanisms are disabled by design or due to improper initialization during deployment. As a result, the media streaming service does not require any form of credential verification before granting access to its resources. This architectural oversight effectively transforms what should be a secured surveillance feed into an openly accessible data stream for any entity capable of reaching the device on the network.
From a technical perspective, the core issue lies in the absence of authentication checks within the RTSP protocol implementation. When a client initiates a connection request to retrieve live media streams, the server accepts these requests without validating user identity or permissions. Consequently, remote attackers who can reach the camera over the local area network or through exposed internet ports can interact with the service directly. The data transmitted via this channel consists of H.264 encoded video and G.711 audio feeds, which are delivered using Real-time Transport Protocol (RTP) over User Datagram Protocol (UDP). Because authentication is bypassed, there is no mechanism to restrict access based on user roles or credentials, allowing any actor with network connectivity to initiate stream retrieval sessions.
The operational impact of this vulnerability is severe due to the combination of unauthenticated access and lack of encryption. Attackers can intercept live video and audio feeds in cleartext, meaning the data is transmitted without confidentiality protections such as TLS or SRTP. This exposure allows for comprehensive surveillance capabilities where an adversary can monitor private spaces, observe sensitive activities, or gather intelligence on individuals within range of the camera. The use of UDP further complicates mitigation efforts from a network security standpoint, as it does not provide built-in reliability mechanisms and is often permitted through firewalls that prioritize low-latency streaming traffic. This configuration effectively creates a persistent backdoor for privacy violations and potential stalking or espionage activities depending on the deployment context of the camera.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing authentication requirements before granting access to sensitive resources. It also maps directly to MITRE ATT&CK technique T1071, Application Layer Protocol, where adversaries use standard protocols like RTSP and RTP for command and control or data exfiltration without triggering typical security alerts due to the benign nature of streaming traffic. Furthermore, the lack of encryption relates to CWE-319, Cleartext Transmission of Sensitive Information, exposing user privacy to passive network sniffing attacks by any party with packet capture capabilities on the same subnet or segment.
To mitigate this risk, immediate action is required from both device manufacturers and end-users. Manufacturers should enforce authentication as a mandatory default setting in all firmware versions prior to HMT.CM2005-v220608.1837, ensuring that no camera ships with open access capabilities enabled by default. For existing deployments, administrators must manually enable authentication features within the device configuration interface if available. Additionally, network segmentation strategies should be employed to isolate IoT devices from critical infrastructure and general user networks. Implementing strict firewall rules that restrict RTSP traffic to authorized management subnets only can significantly reduce the attack surface. Upgrading to patched firmware versions where this default is corrected remains the most effective long-term solution for resolving this exposure.