CVE-2026-79394

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.

Published 2026-09-11. Last modified 2026-09-22.