CVE-2026-79395 in IP Camera
Summary
by MITRE • 09/11/2026
An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream URL retrieval, and system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Sofia IPC daemon of Xiongmai IP Camera firmware versions HMT.CM2005-v220608.1837 and earlier represents a critical failure in access control mechanisms, specifically within the implementation of WS-Security UsernameToken verification. This flaw allows unauthenticated remote attackers to bypass authentication checks entirely by exploiting logic errors in how the system validates credentials against stored hashes or empty password fields. The core technical issue lies in the improper handling of user accounts where the stored password is null or empty. Instead of rejecting such requests as invalid due to missing cryptographic proof, the daemon incorrectly accepts any provided credential string for these specific accounts, effectively treating an arbitrary input as a valid authentication token. This behavior violates fundamental security principles regarding identity verification and access control enforcement.
From a technical perspective, this vulnerability maps directly to CWE-287 Improper Authentication, where the system fails to correctly verify that a claimed entity is indeed what it claims to be. The attack vector involves sending crafted SOAP requests over the network interface targeting the ONVIF service endpoints. By supplying the admin username along with any arbitrary password value, an attacker can successfully authenticate as the administrator without possessing the actual secret key. This bypass mechanism exploits the specific condition where the backend database or configuration file contains a null entry for the user's password hash. The Sofia IPC daemon processes this request and grants session privileges based on the presence of the username rather than validating the integrity of the provided credentials against the stored value, leading to a complete compromise of the authentication layer.
The operational impact of this vulnerability is severe due to the high-privilege nature of the ONVIF protocol interface commonly found in Internet of Things devices like IP cameras. Once authenticated through this flaw, an attacker gains full administrative control over the device capabilities defined by the ONVIF standard. This includes the ability to perform Pan-Tilt-Zoom (PTZ) operations on the camera lens, retrieve live and recorded stream URLs for surveillance footage interception, and execute system-level commands such as rebooting the device. The retrieval of stream URLs poses a significant privacy risk, allowing unauthorized parties to monitor private spaces without detection. Furthermore, the ability to trigger system reboots can lead to denial-of-service conditions or potentially disrupt security monitoring operations if deployed maliciously by an adversary seeking to create blind spots in surveillance coverage.
This exploitation scenario aligns with several tactics within the MITRE ATT&CK framework for IoT environments. It corresponds primarily to Initial Access techniques involving Valid Accounts, specifically when those accounts have weak or default configurations that allow bypassing authentication requirements. The subsequent actions of retrieving stream data and controlling PTZ functions fall under Discovery and Collection phases, where an attacker gathers information about the network environment and surveillance capabilities. If used for disruption, the reboot capability relates to Impact tactics aimed at denying service availability. The vulnerability highlights a common pitfall in embedded device development where convenience or incomplete implementation overrides strict security validation protocols during the authentication handshake process of web services like WS-Security.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. For affected systems, the most effective mitigation is to apply firmware updates provided by Xiongmai that address this logic error in the Sofia IPC daemon's verification routine. Administrators should ensure that no administrative accounts are configured with empty or null passwords; instead, strong, complex passwords must be enforced for all privileged users. Additionally, network-level controls such as firewall rules restricting access to ONVIF and SOAP endpoints to trusted IP addresses only can reduce the attack surface available to remote attackers. Implementing mutual TLS authentication where possible adds an additional layer of security that is not susceptible to password-based bypasses. Regular vulnerability assessments and penetration testing focused on web service implementations in IoT devices are essential to identify similar improper authentication flaws before they can be exploited in production environments.