External risk intelligence

Xiongmai IP Camera Sofia IPC Daemon Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-79395

The vulnerability affects an IP camera management service reachable via SOAP requests. These devices are frequently deployed as internet-facing or edge-reachable hardware for remote monitoring and access, making the management interface a commonly exposed surface.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Xiongmai IP Camera firmware could allow unauthorized remote access to critical functions. It impacts the Sofia IPC daemon's WS-Security routine, potentially enabling attackers to bypass authentication and control camera operations. The main concern is confirming relevance and exposure to business systems.

Bypasses camera security for remote control.
Affects widely deployed IP camera systems.
Confirm relevance and exposure to business systems.

Attack Path

How an attacker could exploit the issue

An attacker can remotely send a specially crafted SOAP request to a vulnerable IP camera's Sofia IPC daemon. This request exploits a flaw in how the device verifies WS-Security usernames and tokens, allowing the attacker to bypass authentication. If successful, the attacker can then perform unauthorized privileged actions on the camera, such as controlling its movement, obtaining video stream information, or even restarting the device.

Accessible over the network.
Crafted SOAP request with valid username.
Unauthorized privileged actions.

Live Threat

Current exploitation, exposure, and threat context

An improper authentication vulnerability in the Sofia IPC daemon could allow unauthenticated remote attackers to bypass security controls and perform privileged actions on Xiongmai IP Camera firmware. This could occur when an account's stored password is empty, enabling attackers to execute commands like retrieving stream URLs, controlling pan-tilt-zoom, or rebooting the system by sending a crafted SOAP request.

IP camera system control.
Bypass authentication via crafted SOAP requests.
Unauthorized access and system disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Xiongmai IP Camera firmware likely impacts device owners and the teams responsible for managing networked IoT devices. The first practical step is to identify all deployed cameras, confirm their network exposure and business criticality, and then locate the accountable owner to plan remediation or mitigation strategies, potentially involving vendor coordination for firmware updates.

Identify and confirm device ownership.
Verify network exposure and criticality.
Plan remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sofia IPC daemon in Xiongmai IP cameras?

The Sofia IPC daemon is a background software component running within Xiongmai IP Camera firmware, specifically on models like the XM530. It manages essential camera operations, including ONVIF communication, which allows the camera to interact with network video recorders and other monitoring software by handling commands like remote movement, stream retrieval, and system management.

What does CWE-287 mean for CVE-2026-79395?

CWE-287 refers to improper authentication. In the context of this vulnerability, it means the software fails to correctly verify the identity of a user before granting access. Specifically, the camera's security routine improperly validates login attempts, allowing an attacker to bypass standard identity checks and execute commands without providing a legitimate password.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically formatted SOAP request to the device. The exploit succeeds when the device's administrative account has an empty password stored in its configuration. The bug is not triggered if the administrator has set a non-empty password, as the verification routine then functions as intended.

Is my device at risk if it is not on the public internet?

Halo Surface Signal notes that while these devices are frequently deployed as internet-facing hardware, the vulnerability exists at the network level. Even if a camera is not directly exposed to the open internet, it remains at risk if it is reachable by any compromised or unauthorized device within your internal network that can send SOAP traffic to the camera.

How should I respond to this vulnerability?

Start by identifying all Xiongmai IP cameras across your environment. Check if these devices use empty administrative passwords, as this is a primary requirement for the vulnerability. Once identified, restrict network access to these cameras to trusted segments only, and coordinate with the vendor or your supply chain contacts to determine if a firmware update is available to resolve the authentication logic error.

References

github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-202…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.