CVE-2025-14748
📋 TL;DR
This vulnerability in Ningyuanda TC155 57.0.2.0 allows attackers on the local network to perform unauthorized factory resets via the ONVIF Device Management Service. By manipulating the FactoryDefault argument with 'Hard' input, attackers can bypass access controls and reset the device to factory settings. This affects organizations using vulnerable TC155 devices on their networks.
💻 Affected Systems
- Ningyuanda TC155
📦 What is this software?
Tc155 Firmware by Shenzhenningyuandatechnology
⚠️ Risk & Real-World Impact
Worst Case
Complete device reset causing service disruption, loss of configuration, and potential device compromise requiring physical reconfiguration.
Likely Case
Unauthorized factory reset leading to service downtime and configuration loss requiring administrative intervention.
If Mitigated
No impact if proper network segmentation and access controls prevent local network access to vulnerable devices.
🎯 Exploit Status
Exploit requires simple HTTP request to /onvif/device_service endpoint with specific parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider workarounds or device replacement.
🔧 Temporary Workarounds
Network Segmentation
allIsolate TC155 devices on separate VLAN or network segment to prevent unauthorized local network access.
Firewall Rules
allBlock access to ONVIF service ports (typically 80, 443, 8080) from untrusted networks and devices.
🧯 If You Can't Patch
- Physically isolate vulnerable devices on separate network segments
- Implement strict network access controls and monitor for unauthorized reset attempts
🔍 How to Verify
Check if Vulnerable:
Test if HTTP POST request to /onvif/device_service with FactoryDefault=Hard parameter triggers factory reset without authentication.Check Version:
Check device web interface or documentation for firmware version information.Verify Fix Applied:
Verify same request fails or requires authentication after implementing network controls.📡 Detection & Monitoring
Log Indicators:
- Unexpected factory reset events
- Unauthorized access to ONVIF endpoints
- HTTP POST requests to /onvif/device_service with FactoryDefault parameter
Network Indicators:
- HTTP traffic to device ONVIF service with reset parameters
- Unusual device reconfiguration patterns
SIEM Query:
source_ip=* dest_ip=TC155_IP http_method=POST uri_path="/onvif/device_service" http_query="*FactoryDefault=Hard*"