Vulnerabilities

TI-2026-83615 CVE-2026-120226 · GHSA-g8f3-phxq-9ggc

Buffer overflow in Hangzhou Xiongmai P2PAPI.dll P2P SDK

MEDIUM 55

A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00124 Published 2026-11-01 No fix listed CWE-119

TI-2025-40486 CVE-2025-65857 · GHSA-3gw2-m37j-rx57

An issue was discovered in Xiongmai XM530 IP cameras on firmware…

HIGH 72

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00426 Published 2025-12-22 No fix listed CWE-359

TI-2025-40485 CVE-2025-65856 · GHSA-rq32-m8jv-7mjg

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware…

HIGH 82

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video str…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00745 Published 2025-12-22 No fix listed CWE-306

TI-2023-20283 CVE-2023-39068 · GHSA-x7ww-v3r8-f36r

Buffer Overflow vulnerability in NBD80S09S-KLC…

MEDIUM 40

Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin allows a remote attacker t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00828 Published 2023-09-11 No fix listed CWE-120

TI-2022-22423 CVE-2022-45460 · GHSA-pm7h-vr37-wmc9

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000…

HIGH 82

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer over…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05673 Published 2023-03-28 No fix listed CWE-787

TI-2022-22143 CVE-2022-45045 · GHSA-rx5h-hxv6-mwc2

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000…

MEDIUM 45

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02431 Published 2022-12-01 No fix listed CWE-78

TI-2021-16320 CVE-2021-38828 · GHSA-v72g-9wj2-x3w5

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.

MEDIUM 57

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00355 Published 2022-11-14 No fix listed CWE-319

TI-2021-16319 CVE-2021-38827 · GHSA-hhc4-5q24-rm38

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.

HIGH 68

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.006 Published 2022-11-14 No fix listed CWE-294

TI-2021-18262 CVE-2021-41506 · GHSA-6q5r-54qp-4cp9

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS…

MEDIUM 47

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onv…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02328 Published 2022-06-30 No fix listed CWE-287

TI-2020-14315 CVE-2020-22253 · GHSA-cxgc-jm76-g3rq

Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2…

MEDIUM 44

Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39 were all discovered to have port 9530 open which allows unaut…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01099 Published 2022-04-06 No fix listed

TI-2022-09658 CVE-2022-26259 · GHSA-wg24-cp5h-mg67

A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL…

LOW 39

A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-R-MH-V3, AHB80N16T-GS, AHB80N32F4-LME, and NBD90S0VT-QW allows attackers to caus…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.02382 Published 2022-03-28 No fix listed CWE-120

TI-2019-08906 CVE-2019-11878 · GHSA-4gcx-xcfm-vwwv

An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200…

LOW 31

An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras.

CVSS 3.0MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00922 Published 2019-05-10 No fix listed CWE-190

TI-2018-12751 CVE-2018-17919 · GHSA-x7pj-758f-q7rv

Hard-coded credentials in Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server

LOW 31

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.00987 Published 2018-10-10 No fix listed CWE-912

TI-2018-12749 CVE-2018-17917 · GHSA-hx93-w6p2-8rvj

Information disclosure in Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server

LOW 27

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01251 Published 2018-10-10 No fix listed CWE-341

TI-2018-12747 CVE-2018-17915 · GHSA-7h63-9wr7-vcw2

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not…

MEDIUM 44

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0107 Published 2018-10-10 No fix listed CWE-311

TI-2018-07153 CVE-2018-10088 · GHSA-3h69-fjjv-586m

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a…

HIGH 69

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.39715 Published 2018-06-08 No fix listed CWE-119

TI-2017-12293 CVE-2017-16725 · GHSA-qr7g-vf43-mfwf

Memory corruption in Xiongmai Technology IP Cameras and DVRs

MEDIUM 54

A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.09216 Published 2017-12-20 No fix listed CWE-119

TI-2017-05216 CVE-2017-7577 · GHSA-rgg2-jx9v-88r4

XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request.

HIGH 65

XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.2827 Published 2017-04-07 No fix listed CWE-22

Vulnerabilities

Filters