CVE-2025-65857 describes a vulnerability in Xiongmai XM530 IP cameras on a specific firmware version where the GetStreamUri API exposes RTSP URIs embedding hardcoded credentials. This exposure allows unauthenticated remote attackers to access video streams directly, bypassing normal authentication controls. The vulnerability is classified under CWE-359 (Exposure of Private Information Through Data Query Logic). The CVSS 3.1 base score is 7.5, indicating high severity due to network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker can gain unauthorized access to live video streams from affected Xiongmai XM530 IP cameras by exploiting the exposed RTSP URIs containing hardcoded credentials. This results in a confidentiality breach of potentially sensitive video data. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected cameras, especially from untrusted networks, to reduce exposure. Monitor for updates from the vendor regarding patches or mitigations.