CVE-2026-79394CWE-1188

CVE-2026-79394

High · published September 11, 2026

CVSS v3.1

7.5

EPSS

Percentile

48.2

In the wild

Unconfirmed

What it is

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00604 · 48.2th percentile
Weakness: CWE-1188 · Initialization of a Resource with an Insecure Default
Published: 2026-09-11T23:17Z

References (1)

https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79394 · [email protected]

EPSS history

Timeline

13 SEP 03:23Z
EPSS moved — → 0%
epss
11 SEP 00:00Z
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware…
cvelistv5