Description

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T19:17:46.070Z",
  "pubdate": "2026-09-11T19:17:46.070Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the WS-Addressing Action transformation function of the Sofia IPC daemon found in Xiongmai IP Camera XM530 firmware.\nThe vulnerability allows remote, unauthenticated attackers to trigger a heap corruption condition, resulting in a denial-of-service (DoS) state or the potential execution of arbitrary code.\nThe flaw stems from improper input validation when processing the wsa5:Action string within SOAP requests, where input exceeding 128 bytes leads to out-of-bounds memory writes.\nGiven the nature of the target devices, successful exploitation poses a significant security risk, as it permits unauthenticated remote code execution (RCE) on the camera's underlying operating system.\nThis vulnerability is particularly dangerous as it requires no prior authentication, allowing attackers to compromise affected devices directly via the network interface.\nOperators of affected XM530 devices are at high risk until mitigation or firmware updates are applied, as the vulnerability does not require interaction from the user once the crafted SOAP request is delivered to the target daemon.",
  "technicalDetails": "The vulnerability resides within the Sofia IPC daemon, specifically in the transformation logic responsible for handling WS-Addressing headers in SOAP requests.\nThe root cause is a failure to enforce length constraints on the 'wsa5:Action' header field before copying the data into a statically allocated heap buffer.\nThe affected function allocates a buffer intended to store the Action string, but fails to implement adequate boundary checking for incoming SOAP payloads.\nWhen a malicious actor transmits a crafted SOAP request containing a wsa5:Action string greater than 128 bytes, the underlying memory copy operation overflows the destination heap buffer.\nThis overflow allows an attacker to overwrite adjacent heap metadata, function pointers, or data structures stored on the heap segment.\nBy precisely controlling the contents of the overflowed data, an attacker can manipulate the program's execution flow, potentially redirecting control to arbitrary code segments or shellcode injected into the heap.\nThe exploitation flow begins with the attacker establishing a network connection to the Sofia IPC daemon. The attacker sends a malformed SOAP XML body to the SOAP service endpoint. The daemon parses the SOAP message, extracts the 'wsa5:Action' field, and passes it to the vulnerable transformation function.\nBecause there is no validation check against the 128-byte limit, the memory copy mechanism continues to write past the allocated buffer's boundary.\nIf the heap metadata is corrupted, the application will typically crash, resulting in a denial-of-service condition. However, if the attacker successfully overwrites critical pointers or sensitive objects, they can achieve arbitrary code execution with the permissions of the Sofia IPC daemon process.\nThis vulnerability affects Xiongmai IP Camera XM530 firmware version HMT.CM2005-v220608.1837 and all preceding versions. Since the service is exposed over the network, it does not require local access, and the absence of authentication requirements makes this a highly accessible target for remote exploitation across the public or internal network."
}