CVE-2025-14749
📋 TL;DR
This vulnerability allows unauthorized remote control of PTZ (Pan-Tilt-Zoom) cameras on the Ningyuanda TC155 device via the ONVIF interface. Attackers on the local network can manipulate camera positioning and functions without authentication. Only users of Ningyuanda TC155 version 57.0.2.0 are affected.
💻 Affected Systems
- Ningyuanda TC155
📦 What is this software?
Tc155 Firmware by Shenzhenningyuandatechnology
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full control of surveillance cameras, potentially disabling monitoring, pointing cameras away from sensitive areas, or causing physical damage through excessive movement.
Likely Case
Unauthorized camera manipulation leading to surveillance blind spots, privacy violations, or disruption of security monitoring.
If Mitigated
Limited to network reconnaissance if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Public exploit available on GitHub, requires local network access only.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None (vendor did not respond)
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacement.
🔧 Temporary Workarounds
Network Segmentation
allIsolate TC155 devices on separate VLAN with strict access controls
Disable ONVIF Interface
allTurn off ONVIF PTZ Control Interface if not required
🧯 If You Can't Patch
- Implement strict network ACLs to block all access to /onvif/device_service endpoint
- Monitor network traffic for unauthorized ONVIF protocol requests
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated ONVIF PTZ commands work via local network to /onvif/device_service endpointCheck Version:
Check device web interface or documentation for firmware versionVerify Fix Applied:
Verify that ONVIF PTZ commands now require authentication or are blocked📡 Detection & Monitoring
Log Indicators:
- Unauthorized ONVIF protocol requests
- PTZ control commands from unexpected IPs
Network Indicators:
- ONVIF SOAP requests to /onvif/device_service without authentication
SIEM Query:
source_ip NOT IN authorized_list AND dest_port=80 AND uri_path="/onvif/device_service"