PT-2025-51364 · Ningyuanda · Ningyuanda Tc155

Keroomi · Publicado 2025-12-16 · Atualizado 2025-12-17 · CVE-2025-14748

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ningyuanda TC155 version 57.0.2.0

Description A flaw exists in Ningyuanda TC155 version 57.0.2.0 related to improper access controls within the ONVIF Device Management Service component. The issue stems from manipulating the FactoryDefault argument with the input Hard in the file /onvif/device service. This requires access to the local network. The exploit has been publicly disclosed. The vendor was contacted but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Improper Access Control

Enumeração de Fraquezas

CWE-266

CWE-284

Identificadores relacionados

CVE-2025-14748

Produtos afetados

Ningyuanda Tc155

Referências · 9

• 🔥 https://github.com/pwnpwnpur1n/IoT-advisories/blob/main/TC155-Unauth-Hard-Reset.md · Exploit
• https://twitter.com/CVEnew/status/2001365832966799864 · Publicação no Twitter
• https://vuldb.com/?submit.707197 · Nota
• https://t.me/CVEtracker/39911 · Publicação no Telegram
• https://t.me/cveNotify/145893 · Publicação no Telegram
• https://vuldb.com/?ctiid.336521 · Nota
• https://osv.dev/vulnerability/CVE-2025-14748 · Aviso do Fabricante
• https://vuldb.com/?id.336521 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14748 · Nota de Segurança