CVE-2026-79393: Xiongmai IP Camera RCE Vulnerability

CVE-2026-79393 Overview

CVE-2026-79393 is a heap-based buffer overflow [CWE-122] in the WS-Addressing Action transformation function within the Sofia IPC daemon on Xiongmai IP Camera XM530 firmware. The vulnerability affects firmware version HMT.CM2005-v220608.1837 and earlier. Remote unauthenticated attackers can trigger the overflow by sending a crafted SOAP request that contains a wsa5:Action string exceeding 128 bytes. Successful exploitation causes denial of service and may allow arbitrary code execution on the camera. The Sofia daemon handles ONVIF/SOAP traffic on network-exposed ports, making the flaw reachable across any network path to the device.

Critical Impact
Unauthenticated network attackers can crash the Sofia IPC daemon or potentially execute arbitrary code on affected Xiongmai IP cameras through a single crafted SOAP request.

Affected Products

Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837
Xiongmai IP Camera XM530 firmware versions earlier than HMT.CM2005-v220608.1837
Sofia IPC daemon component handling WS-Addressing SOAP requests

Discovery Timeline

2026-09-11 - CVE-2026-79393 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-79393

Vulnerability Analysis

The Sofia IPC daemon processes SOAP requests that implement the WS-Addressing specification. Incoming SOAP envelopes carry a wsa5:Action element that identifies the requested ONVIF operation. During request parsing, the daemon copies the Action string into a fixed-size heap buffer without validating its length against the destination size. When the supplied Action value exceeds 128 bytes, the copy operation writes past the allocated buffer boundary and corrupts adjacent heap metadata and objects.

The daemon runs as a long-lived service that handles device management, streaming control, and event delivery. A crash therefore takes the camera offline until it is manually or automatically restarted. Because the overwrite occurs on the heap, an attacker with sufficient knowledge of the allocator layout can shape allocations to hijack control flow and achieve remote code execution as the daemon process.

Root Cause

The root cause is missing bounds checking in the WS-Addressing Action transformation function. The function assumes the SOAP header field fits inside a 128-byte destination buffer and uses an unsafe copy primitive without length validation. This pattern maps directly to [CWE-122] Heap-based Buffer Overflow.

Attack Vector

Exploitation requires only network reachability to the camera's SOAP/ONVIF listener. No credentials, user interaction, or prior access are required. An attacker sends a single HTTP POST containing a SOAP envelope whose wsa5:Action header value is longer than 128 bytes. The oversized string overflows the heap buffer during parsing, producing an immediate denial of service or, with additional exploitation work, arbitrary code execution in the context of the Sofia daemon.

The vulnerability mechanism is described in the public research repository referenced by the NVD entry. See the GitHub PoC Repository for CVE-2026-79393 for technical details.

Detection Methods for CVE-2026-79393

Indicators of Compromise

SOAP requests to the camera containing a wsa5:Action header value longer than 128 bytes
Repeated unexpected restarts or crashes of the Sofia IPC daemon on XM530-based cameras
Unusual outbound connections from IP cameras following inbound ONVIF/SOAP traffic from untrusted sources
HTTP POST bodies to ONVIF endpoints containing anomalously long WS-Addressing header fields

Detection Strategies

Deploy network intrusion detection signatures that inspect SOAP payloads for wsa5:Action values exceeding 128 bytes
Monitor camera management interfaces for HTTP request bodies with abnormal header field lengths targeting ONVIF endpoints
Baseline normal ONVIF traffic patterns and alert on requests from source IPs outside expected management networks
Correlate camera reboots and connectivity loss with preceding inbound SOAP requests to identify exploitation attempts

Monitoring Recommendations

Log all traffic to and from IP camera management ports and forward to a central analytics platform
Track process uptime for the Sofia daemon where telemetry is available to detect abnormal restart cycles
Alert on any new outbound connections initiated by IP cameras to internet-facing destinations
Review firewall logs for ONVIF or SOAP traffic originating outside the designated video surveillance VLAN

How to Mitigate CVE-2026-79393

Immediate Actions Required

Restrict network access to affected Xiongmai XM530 cameras so that only authorized management hosts can reach ONVIF/SOAP ports
Place all IP cameras on an isolated VLAN with no direct internet exposure and no route to sensitive internal segments
Inventory deployed camera firmware versions and identify devices running HMT.CM2005-v220608.1837 or earlier
Monitor Xiongmai support channels for updated firmware that addresses the WS-Addressing Action handling flaw

Patch Information

No vendor advisory or fixed firmware version is listed in the NVD entry at the time of publication. Operators should track Xiongmai firmware releases and apply any update that supersedes HMT.CM2005-v220608.1837 once available. Until a patch is published, network-level containment is the only reliable mitigation.

Workarounds

Block inbound SOAP/ONVIF traffic from untrusted networks at the perimeter firewall
Terminate ONVIF sessions at a reverse proxy or ONVIF-aware gateway that enforces maximum SOAP header lengths
Disable ONVIF services on cameras where the feature is not required by the video management system
Apply access control lists on switches to allow SOAP traffic only from the video management server IP addresses

bash

# Example: restrict ONVIF/SOAP access to the camera VLAN using iptables
# Allow only the video management server (VMS_IP) to reach camera SOAP port
VMS_IP="10.10.20.5"
CAMERA_NET="10.20.30.0/24"
iptables -A FORWARD -p tcp -s $VMS_IP -d $CAMERA_NET --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d $CAMERA_NET --dport 80 -j DROP
iptables -A FORWARD -p tcp -d $CAMERA_NET --dport 8899 -j DROP