{“lastseen”:”2026-02-06T18:17:09″,”description”:”This project is a unified PHP-based security scanner designed to identify critical vulnerabilities in IP cameras, with a primary focus on ONVIF authentication bypass CVE-2025-65856 and unauthenticated RTSP stream exposure. The tool provides a…”,”published”:”2026-02-06T00:00:00″,”modified”:”2026-02-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Xiongmai XM530 ONVIF \/ RTSP Security Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:215053″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-65856″],”sourceData”:”=============================================================================================================================================\\n | # Title : Xiongmai XM530 ONVIF \\u0026 RTSP Security Scanner for IP Cameras |\\n | # Author : indoushka4ever@gmail.com |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/www.xiongmaitech.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/213044\/ \\u0026 CVE-2025-65856\\n \\n [+] Summary : This project is a unified PHP-based security scanner designed to identify critical vulnerabilities in IP cameras, \\n with a primary focus on ONVIF authentication bypass (CVE-2025-65856) and unauthenticated RTSP stream exposure.\\n The tool provides a single-file web interface that allows scanning a single IP address or an entire network range (CIDR), detecting exposed services, \\n \\t\\t\\t\\t fingerprinting device information (manufacturer and model), and assessing risk severity (LOW, MEDIUM, HIGH, CRITICAL).\\n The scanner is optimized for defensive security assessments and SOC use cases, generating structured JSON-compatible results suitable for SIEM ingestion. \\n \\t\\t\\t\\t It operates without external libraries, supports AJAX-based scanning without page reloads, and is fully compatible with standard PHP environments such as XAMPP.\\n \\n [+] Key capabilities include:\\n \\n Detection of ONVIF authentication bypass vulnerabilities\\n \\n Identification of exposed RTSP streams without credentials\\n \\n Automatic severity classification based on exposure level\\n \\n Device fingerprinting (manufacturer \/ model when available)\\n \\n Network-wide scanning via CIDR notation\\n \\n Lightweight, single-file PHP web interface\\n \\n Read-only, non-destructive Proof-of-Concept suitable for lawful security testing\\n \\n [+] POC : How to Use It\\n \\n Place the file inside: htdocs\/camera_scanner.php\\n \\n Open your browser:http:\/\/localhost\/camera_scanner.php\\n \\n Example Input :192.168.1.10 or 192.168.1.0\/24\\n \\n \\u003c?php\\n \\n set_time_limit(0);\\n error_reporting(E_ALL \\u0026 ~E_WARNING);\\n \\n function port_open($ip, $port, $timeout = 2) {\\n $fp = @fsockopen($ip, $port, $errno, $errstr, $timeout);\\n if ($fp) {\\n fclose($fp);\\n return true;\\n }\\n return false;\\n }\\n \\n function severity($onvif, $rtsp) {\\n if ($onvif \\u0026\\u0026 $rtsp) return \\”CRITICAL\\”;\\n if ($onvif) return \\”HIGH\\”;\\n if ($rtsp) return \\”MEDIUM\\”;\\n return \\”LOW\\”;\\n }\\n \\n function check_onvif($ip, $port) {\\n $soap = \\u003c\\u003c\\u003cXML\\n \\u003c?xml version=\\”1.0\\” encoding=\\”UTF-8\\”?\\u003e\\n \\u003cs:Envelope xmlns:s=\\”http:\/\/www.w3.org\/2003\/05\/soap-envelope\\”\\u003e\\n \\u003cs:Body\\u003e\\n \\u003cGetDeviceInformation xmlns=\\”http:\/\/www.onvif.org\/ver10\/device\/wsdl\\”\/\\u003e\\n \\u003c\/s:Body\\u003e\\n \\u003c\/s:Envelope\\u003e\\n XML;\\n \\n $opts = [\\n ‘http’ =\\u003e [\\n ‘method’ =\\u003e \\”POST\\”,\\n ‘header’ =\\u003e \\”Content-Type: application\/soap+xml\\\\r\\\\n\\”,\\n ‘content’ =\\u003e $soap,\\n ‘timeout’ =\\u003e 3\\n ]\\n ];\\n \\n $ctx = stream_context_create($opts);\\n $url = \\”http:\/\/$ip:$port\/onvif\/device_service\\”;\\n $res = @file_get_contents($url, false, $ctx);\\n \\n if ($res \\u0026\\u0026 strpos($res, \\”Manufacturer\\”) !== false) {\\n preg_match(‘\/\\u003cManufacturer\\u003e(.*?)\\u003c\\\\\/Manufacturer\\u003e\/’, $res, $m);\\n preg_match(‘\/\\u003cModel\\u003e(.*?)\\u003c\\\\\/Model\\u003e\/’, $res, $mo);\\n return [\\n \\”onvif\\” =\\u003e true,\\n \\”manufacturer\\” =\\u003e $m[1] ?? \\”Unknown\\”,\\n \\”model\\” =\\u003e $mo[1] ?? \\”Unknown\\”,\\n \\”port\\” =\\u003e $port\\n ];\\n }\\n return [\\”onvif\\” =\\u003e false];\\n }\\n \\n function check_rtsp($ip, $port) {\\n $fp = @fsockopen($ip, $port, $e, $s, 2);\\n if ($fp) {\\n fwrite($fp, \\”OPTIONS rtsp:\/\/$ip RTSP\/1.0\\\\r\\\\nCSeq: 1\\\\r\\\\n\\\\r\\\\n\\”);\\n $r = fread($fp, 256);\\n fclose($fp);\\n if (strpos($r, \\”RTSP\\”) !== false) return true;\\n }\\n return false;\\n }\\n \\n function scan_ip($ip) {\\n $onvif = false;\\n $rtsp = false;\\n $info = [];\\n \\n foreach ([80,8899,8080] as $p) {\\n if (port_open($ip, $p)) {\\n $r = check_onvif($ip, $p);\\n if ($r[‘onvif’]) {\\n $onvif = true;\\n $info = $r;\\n break;\\n }\\n }\\n }\\n \\n foreach ([554,8554] as $p) {\\n if (port_open($ip, $p) \\u0026\\u0026 check_rtsp($ip, $p)) {\\n $rtsp = true;\\n $info[‘rtsp_port’] = $p;\\n break;\\n }\\n }\\n \\n return [\\n \\”ip\\” =\\u003e $ip,\\n \\”onvif\\” =\\u003e $onvif,\\n \\”rtsp\\” =\\u003e $rtsp,\\n \\”manufacturer\\” =\\u003e $info[‘manufacturer’] ?? \\”-\\”,\\n \\”model\\” =\\u003e $info[‘model’] ?? \\”-\\”,\\n \\”severity\\” =\\u003e severity($onvif, $rtsp),\\n \\”time\\” =\\u003e date(\\”Y-m-d H:i:s\\”)\\n ];\\n }\\n \\n \/* ================= AJAX ================= *\/\\n \\n if (isset($_POST[‘target’])) {\\n $target = trim($_POST[‘target’]);\\n $results = [];\\n \\n if (strpos($target, \\”\/\\”) !== false) {\\n [$net, $cidr] = explode(\\”\/\\”, $target);\\n $mask = ~((1 \\u003c\\u003c (32 – $cidr)) – 1);\\n $start = ip2long($net) \\u0026 $mask;\\n $end = $start | ~$mask;\\n \\n for ($i = $start + 1; $i \\u003c $end; $i++) {\\n $ip = long2ip($i);\\n $r = scan_ip($ip);\\n if ($r[‘onvif’] || $r[‘rtsp’]) {\\n $results[] = $r;\\n }\\n }\\n } else {\\n $results[] = scan_ip($target);\\n }\\n \\n header(\\”Content-Type: application\/json\\”);\\n echo json_encode($results, JSON_PRETTY_PRINT);\\n exit;\\n }\\n ?\\u003e\\n \\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml lang=\\”ar\\” dir=\\”rtl\\”\\u003e\\n \\u003chead\\u003e\\n \\u003cmeta charset=\\”utf-8\\”\\u003e\\n \\u003ctitle\\u003eCamera Security Scanner\\u003c\/title\\u003e\\n \\u003cstyle\\u003e\\n body{font-family:tahoma;background:#0f172a;color:#e5e7eb}\\n .box{width:900px;margin:30px auto;background:#020617;padding:20px;border-radius:10px}\\n input,button{padding:10px;width:100%;margin:5px 0}\\n button{background:#2563eb;color:#fff;border:0;cursor:pointer}\\n pre{background:#020617;padding:10px;max-height:400px;overflow:auto}\\n .CRITICAL{color:#dc2626}\\n .HIGH{color:#f97316}\\n .MEDIUM{color:#eab308}\\n \\u003c\/style\\u003e\\n \\u003c\/head\\u003e\\n \\n \\u003cbody\\u003e\\n \\u003cdiv class=\\”box\\”\\u003e\\n \\u003ch2\\u003e\ud83d\udd0d \u0641\u062d\u0635 \u0643\u0627\u0645\u064a\u0631\u0627\u062a ONVIF \/ RTSP\\u003c\/h2\\u003e\\n \\n \\u003cinput id=\\”target\\” placeholder=\\”192.168.1.10 \u0623\u0648 192.168.1.0\/24\\”\\u003e\\n \\u003cbutton onclick=\\”scan()\\”\\u003e\u0627\u0628\u062f\u0623 \u0627\u0644\u0641\u062d\u0635\\u003c\/button\\u003e\\n \\n \\u003cpre id=\\”out\\”\\u003e\\u003c\/pre\\u003e\\n \\u003c\/div\\u003e\\n \\n \\u003cscript\\u003e\\n function scan(){\\n document.getElementById(\\”out\\”).textContent=\\”\u062c\u0627\u0631\u064a \u0627\u0644\u0641\u062d\u0635…\\”;\\n fetch(\\”\\”,{\\n method:\\”POST\\”,\\n headers:{\\”Content-Type\\”:\\”application\/x-www-form-urlencoded\\”},\\n body:\\”target=\\”+encodeURIComponent(document.getElementById(\\”target\\”).value)\\n })\\n .then(r=\\u003er.json())\\n .then(d=\\u003e{\\n let o=\\”\\”;\\n d.forEach(x=\\u003e{\\n o+=`[${x.severity}] ${x.ip} | ONVIF:${x.onvif} RTSP:${x.rtsp}\\\\n`;\\n });\\n document.getElementById(\\”out\\”).textContent=o;\\n });\\n }\\n \\u003c\/script\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215053″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215053\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-06T18:17:09″,”description”:”This project is a unified PHP-based security scanner designed to identify critical vulnerabilities in IP cameras, with a primary focus on ONVIF authentication bypass CVE-2025-65856…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-39433","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n