CVE-2026-79394 Overview
CVE-2026-79394 is an insecure default configuration vulnerability [CWE-1188] in the embedded Happytime Real Time Streaming Protocol (RTSP) server within the Sofia IPC daemon. The flaw affects Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier. The RTSP server ships with authentication disabled by default. Remote unauthenticated attackers can access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP. The vulnerability requires no privileges, no user interaction, and is exploitable over the network.
Critical Impact
Any attacker with network reachability to the camera can stream live video and audio without credentials, enabling surveillance abuse and privacy violations.
Affected Products
- Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837
- Earlier XM530 firmware revisions running the same Sofia IPC daemon
- Embedded Happytime RTSP server component within Sofia IPC
Discovery Timeline
- 2026-09-11 - CVE-2026-79394 published to the National Vulnerability Database
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-79394
Vulnerability Analysis
The Sofia IPC daemon on Xiongmai XM530 cameras embeds the Happytime RTSP server to expose live media streams. The default deployment leaves RTSP authentication disabled, so DESCRIBE, SETUP, and PLAY requests succeed without credentials. Attackers reach the media session by connecting to the RTSP port and negotiating an RTP/UDP transport. The server then streams H.264 video and G.711 audio in cleartext.
Because the transport is unencrypted, on-path adversaries can also passively capture sessions initiated by legitimate clients. The vulnerability affects confidentiality of surveillance feeds without altering device integrity or availability.
Root Cause
The root cause is an insecure default configuration [CWE-1188]. Vendor firmware ships the embedded RTSP service with the authentication requirement turned off. Administrators who deploy the camera on trusted or exposed networks inherit that weak posture unless they manually enable authentication, if the option is even exposed in the management interface.
Attack Vector
Exploitation requires only network reachability to the RTSP service on the camera. An attacker uses any RTSP-capable client to request the stream URL and receives the media without a credential challenge. Details and reproduction notes are available in the GitHub Vulnerability Research repository.
No verified proof-of-concept code has been published beyond the referenced research repository. The vulnerability is exercised through standard RTSP client interactions rather than crafted payloads.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-79394
Indicators of Compromise
- Unexpected inbound RTSP DESCRIBE, SETUP, or PLAY requests from external or unauthorized internal addresses to camera IPs
- RTP/UDP media sessions originating from camera interfaces to unfamiliar destinations
- Absence of 401 Unauthorized responses in RTSP session logs, indicating authentication is disabled
Detection Strategies
- Perform authenticated network scans against Xiongmai XM530 devices to confirm whether the RTSP service accepts anonymous DESCRIBE requests
- Inspect network flow records for RTP/UDP streams sourced from camera VLANs to destinations outside the approved video management system
- Correlate RTSP session metadata with firewall logs to identify streams reaching the internet or untrusted segments
Monitoring Recommendations
- Enable NetFlow or IPFIX collection on switches serving camera subnets and alert on egress RTP traffic
- Use intrusion detection signatures for RTSP methods lacking Authorization headers
- Track firmware version HMT.CM2005-v220608.1837 and earlier in asset inventories to scope exposure
How to Mitigate CVE-2026-79394
Immediate Actions Required
- Block inbound access to the RTSP port on affected cameras at the perimeter and restrict it to authorized video management servers
- Segment IP cameras onto an isolated VLAN with no direct internet exposure
- Enable RTSP authentication in the camera management interface where the option is available
- Rotate any credentials that may have been observed in cleartext RTSP or RTP traffic
Patch Information
No vendor patch has been documented in the NVD entry at the time of publication. Refer to the GitHub Vulnerability Research repository for the latest research notes and consult Xiongmai directly for firmware updates addressing the default configuration.
Workarounds
- Place cameras behind an RTSP-aware proxy that enforces authentication and TLS transport
- Disable the embedded RTSP service if the deployment relies on ONVIF or a different streaming path
- Apply host firewall rules on the camera network gateway to permit RTSP only from the video management system
- Monitor for firmware updates from Xiongmai that change the default authentication posture
# Example: restrict RTSP (TCP/554) to a single video management server
iptables -A FORWARD -p tcp --dport 554 -s 10.20.30.40 -d 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 554 -d 10.10.0.0/24 -j DROP
iptables -A FORWARD -p udp --sport 554 -s 10.10.0.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
