CVE-2026-79393

Heap Buffer Overflow in Xiongmai IPC Daemon

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

Analysis

Technical impact

A heap-based buffer overflow exists in the WS‑Addressing Action transformation within the Sofia IPC daemon of Xiongmai IP Camera XM530 firmware HMT.CM2005‑v220608.1837 and earlier. A crafted SOAP request containing a wsa5:Action string longer than 128 bytes can trigger the overflow, allowing an attacker to either cause a denial of service or potentially execute arbitrary code on the device.

Affected Systems

The vulnerability affects Xiongmai IP Camera XM530 models running firmware HMT.CM2005‑v220608.1837 and earlier. No other vendors or product lines are listed as affected.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity issue with significant impact. The EPSS score of <1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in KEV. The vector is remote, unauthenticated, and requires the ability to send SOAP requests to the IPC daemon over the network; no credentials or privilege escalation are needed. Successful exploitation could lead to service disruption or code execution with the privileges the daemon runs under.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Xiongmai

Ip Camera Xm530

Version	Status	Scheme	Platform
`HMT.CM2005-v220608.1837`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the camera firmware to a version newer than HMT.CM2005‑v220608.1837, if an upgrade is available.
Restrict network access to the camera’s SOAP interface by permitting only trusted IP addresses or by using firewall rules.
Configure a frontend filter or WAF to block SOAP requests whose wsa5:Action string exceeds 128 bytes before they reach the IPC daemon.

Generated by OpenCVE AI on September 21, 2026 at 04:39 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.744% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79393

History

Sep 21, 2026 5:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in Xiongmai IPC Daemon

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Xiongmai Xiongmai ip Camera Xm530
Vendors & Products		Xiongmai Xiongmai ip Camera Xm530

Sep 11, 2026 11:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.
Weaknesses		CWE-122
References		https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79393
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`