Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2855▼ 333 respecto a la semana anterior

Críticas / altas1381▼ 36 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)296▼ 213 respecto a la semana anterior

7 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-79396	Aplazada	Crítica (9.8)	0.58%	—	Xiongmai IP Camera Xm530^AI	11/9/2026	22/9/2026	Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera.
CVE-2026-79395	Aplazada	Crítica (9.8)	0.77%	—	Xiongmai IP Camera Xm530^AI	11/9/2026	22/9/2026	An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream…
CVE-2026-79394	Aplazada	Alta (7.5)	0.60%	—	Xiongmai Xm530^AI Xiongmai Sofia IPC^AI Xiongmai Happytime Rtsp Server^AI	11/9/2026	22/9/2026	An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over…
CVE-2026-79393	Aplazada	Alta (7.5)	0.74%	—	Xiongmai IP Camera Xm530^AI	11/9/2026	22/9/2026	A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP…
CVE-2025-65857	Modificada	Alta (7.5)	0.43%	💥 PoC	Xiongmaitech Xm530v200 X6-weq 8M Firmware	22/12/2025	5/7/2026	An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.
CVE-2025-65856	Modificada	Crítica (9.8)	0.74%	💥 PoC	Xiongmaitech Xm530v200 X6-weq 8M Firmware	22/12/2025	5/7/2026	Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling…
CVE-2024-3765	Aplazada	Crítica (9.8)	1.3%	—	Xiongmai Ahb7804r-mh-v2^AI Xiongmai Ahb8004t-gl^AI Xiongmai Ahb8008t-gl^AI Xiongmai Ahb7004t-gs-v3^AI+3	14/4/2024	17/6/2026	A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input…