Luis Miranda Acebedo

3 exploits Active since Dec 2025
CVE-2025-65856 NOMISEC CRITICAL WRITEUP
Xiongmai XM530 IP Cameras V5.00.R02.000807D8.10010.346624.S.ONVIF - Unauthenticated Sensitive Information Exposure
Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.
2 stars
CVSS 9.8
CVE-2025-65855 NOMISEC MEDIUM WRITEUP
Netun Solutions HelpFlash IoT v18_178_221102_ASCII_PRO_1R5_50 - RCE
The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate update servers or validate firmware signatures. An attacker with brief physical access can activate OTA mode (8-second button press), create a malicious WiFi AP using the known credentials, and serve malicious firmware via unauthenticated HTTP to achieve arbitrary code execution on this safety-critical emergency signaling device.
CVSS 6.6
CVE-2025-65857 NOMISEC HIGH WRITEUP
Xiongmai XM530 IP cameras - Info Disclosure
An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.
CVSS 7.5