CVE-2026-79395: Xiongmai IP Camera Auth Bypass Vulnerability

CVE-2026-79395 Overview

CVE-2026-79395 is an authentication bypass vulnerability in the WS-Security (wsse:UsernameToken) verification routine of the Sofia IPC daemon on Xiongmai IP cameras. The flaw affects XM530 firmware HMT.CM2005-v220608.1837 and earlier. When the admin account has an empty stored password, the verification routine accepts any arbitrary password supplied in a crafted SOAP request. Remote unauthenticated attackers can invoke privileged ONVIF actions, including PTZ control, stream URL retrieval, and system reboot. The vulnerability is tracked under CWE-287: Improper Authentication.

Critical Impact

Unauthenticated network attackers can bypass authentication and issue privileged ONVIF commands to Xiongmai IP cameras, enabling surveillance disruption, unauthorized video stream access, and denial of service via forced reboot.

Affected Products

• Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837
• Earlier XM530-based firmware releases sharing the same Sofia IPC daemon build
• Devices exposing ONVIF endpoints with an empty admin account password

Discovery Timeline

• 2026-09-11 - CVE-2026-79395 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-79395

Vulnerability Analysis

The Sofia IPC daemon implements ONVIF authentication using the WS-Security wsse:UsernameToken profile. This profile expects clients to submit a username, a nonce, a timestamp, and a password digest derived from the account's stored secret. The Sofia verification routine fails to enforce a non-empty stored password constraint before comparing digests.

When the admin account has an empty password, the digest comparison collapses to a trivial state. The routine treats any client-supplied password value as valid. An attacker can then submit crafted SOAP envelopes and execute privileged ONVIF operations without possessing any credential material.

The impact is direct operational control of the camera. Attackers can retrieve RTSP stream URLs, manipulate pan-tilt-zoom (PTZ) positioning, and reboot the device. Fleet-wide exposure is plausible because factory or provisioning defaults on many Xiongmai OEM devices leave the admin password blank.

Root Cause

The root cause is missing precondition validation in the wsse:UsernameToken handler within the Sofia IPC daemon. The handler does not reject authentication attempts targeting accounts with empty stored passwords. This is a classic CWE-287 improper authentication flaw where a boundary case in credential storage collapses the verification logic.

Attack Vector

The attack path requires only network reachability to the camera's ONVIF service, typically exposed on TCP port 80 or 8080. The attacker crafts a SOAP request containing a wsse:UsernameToken element with Username set to admin and any arbitrary Password value. The Sofia daemon accepts the token and authorizes the request. See the GitHub Vulnerability Research CVE-2026-79395 writeup for protocol-level details and reproduction steps.

Detection Methods for CVE-2026-79395

Indicators of Compromise

• Inbound SOAP requests to /onvif/device_service containing wsse:UsernameToken elements from untrusted source addresses
• Unexpected ONVIF GetStreamUri, SystemReboot, or PTZ control calls in Sofia daemon logs
• New or unrecognized RTSP stream sessions originating from external IP ranges
• Camera reboot events without corresponding administrator activity

Detection Strategies

• Inspect HTTP traffic to ONVIF endpoints for wsse:UsernameToken payloads submitted without prior TLS or VPN handshake context
• Alert on ONVIF authentication successes for the admin account when the source is outside management subnets
• Correlate camera reboot telemetry with SOAP request bursts to identify abuse patterns

Monitoring Recommendations

• Enable verbose logging on the Sofia IPC daemon and forward logs to a central collector
• Baseline normal ONVIF API usage per camera and flag deviations in request volume or method mix
• Monitor RTSP session establishment for source IPs outside expected NVR or VMS ranges

How to Mitigate CVE-2026-79395

Immediate Actions Required

• Set a strong, non-empty password on every admin account on affected Xiongmai cameras and any OEM variants sharing the XM530 platform
• Block ONVIF and RTSP ports at the perimeter firewall and restrict access to trusted management subnets or VPN clients
• Audit all deployed cameras for empty administrative passwords before applying any other change

Patch Information

No vendor advisory or fixed firmware version is referenced in the NVD entry at time of publication. Consult the GitHub Vulnerability Research CVE-2026-79395 writeup and the Xiongmai support portal for updated firmware availability. Upgrade to a firmware release later than HMT.CM2005-v220608.1837 once the vendor publishes a fix.

Workarounds

• Place cameras on an isolated VLAN with no direct inbound Internet exposure
• Terminate ONVIF and RTSP access behind an authenticating reverse proxy that enforces its own credential validation
• Disable the ONVIF service on cameras that do not require third-party VMS integration
• Enforce credential provisioning workflows that reject empty passwords during device onboarding

# Configuration example: restrict ONVIF access with iptables on an upstream gateway
iptables -A FORWARD -p tcp --dport 80   -s 10.20.30.0/24 -d 10.10.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp --dport 8080 -s 10.20.30.0/24 -d 10.10.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp --dport 554  -s 10.20.30.0/24 -d 10.10.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.10.0.0/16 --dport 80   -j DROP
iptables -A FORWARD -p tcp -d 10.10.0.0/16 --dport 8080 -j DROP
iptables -A FORWARD -p tcp -d 10.10.0.0/16 --dport 554  -j DROP