CVE-2026-79394
High
Description
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSofia IPC daemon
PublishedSep 11, 2026
First seenSep 11, 2026
Weakness typeCWE-1188CWE-1188
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sofia IPC daemon | No range specified | — |
| Xiongmai IP Camera XM530 firmware HMT.CM2005 | v ≤ 220608.1837 | — |
| Happytime RTSP server | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.