Executive brief
Xiongmai IP cameras contain a flaw in their firmware's ONVIF interface (used for remote video management) that allows unauthenticated attackers to crash the device or potentially gain full control by sending a specially crafted network request. The vulnerability affects the camera's main daemon and can be exploited without any login credentials or user interaction, posing a significant risk to organizations relying on these devices for surveillance.
Technical details
A heap-based buffer overflow (CWE-120/CWE-122) exists in the Sofia IPC daemon's WS-Addressing Action transformation function within the gSOAP-derived ONVIF SOAP stack. The vulnerable code fails to validate the length of a wsa5:Action string before copying it to a fixed 128-byte heap buffer. An unauthenticated remote attacker can send a crafted SOAP/XML request over the network with a wsa5:Action value exceeding 128 bytes, triggering the overflow. This results in heap corruption leading to reliable denial of service (SIGSEGV) and plausible remote code execution. No authentication or user interaction is required; the vulnerability has been confirmed through live reproduction on affected hardware builds (HMT.CM2005-v210104.1124 and HMT.CM2005-v220608.1837).
Affected products
- Xiongmai IP Camera XM530 HMT.CM2005-v220608.1837 and earlier
Timeline
- 2026-09-11: disclosed