A critical authentication bypass vulnerability in Xiongmai XM530 IP cameras allows unauthenticated remote attackers to gain full control over device management functions.

The vulnerability exists within the WS-Security UsernameToken verification routine of the Sofia IPC daemon. An unauthenticated remote attacker can bypass authentication to perform privileged actions, such as PTZ control or system reboots, by providing the admin username with an arbitrary password when the device account lacks a password.

The CVSS score of 9.8 reflects the high severity of this flaw, as it allows for complete unauthorized control over physical security infrastructure. Successful exploitation could lead to the compromise of live video streams, physical manipulation of surveillance hardware, or the permanent denial of service via unauthorized system reboots.

Immediate Action: Contact the device manufacturer or vendor to verify if a firmware update addressing this specific daemon vulnerability has been released for your specific XM530 model.

Proactive Monitoring: Monitor network traffic for anomalous SOAP requests directed at the device ONVIF ports and review system logs for unauthorized administrative state changes.

Compensating Controls: Isolate affected cameras on a dedicated, non-routable management VLAN and implement strict firewall rules to restrict access to the ONVIF service to trusted internal IP addresses only.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability research repository referenced by the CVE record.

Given the critical nature of this vulnerability and the potential for unauthorized access to physical surveillance systems, immediate isolation of affected devices from the public internet is essential. Administrators should prioritize the implementation of network-level access controls while awaiting formal patch information from the vendor.