PT-2025-51364 · Ningyuanda · Ningyuanda Tc155

Keroomi · Published 2025-12-16 · Updated 2025-12-17 · CVE-2025-14748

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ningyuanda TC155 version 57.0.2.0

Description A flaw exists in Ningyuanda TC155 version 57.0.2.0 related to improper access controls within the ONVIF Device Management Service component. The issue stems from manipulating the FactoryDefault argument with the input Hard in the file /onvif/device service. This requires access to the local network. The exploit has been publicly disclosed. The vendor was contacted but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2025-14748

Affected Products

Ningyuanda Tc155

References · 9

• 🔥 https://github.com/pwnpwnpur1n/IoT-advisories/blob/main/TC155-Unauth-Hard-Reset.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-14748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14748 · Security Note
• https://twitter.com/CVEnew/status/2001365832966799864 · Twitter Post
• https://vuldb.com/?submit.707197 · Note
• https://t.me/CVEtracker/39911 · Telegram Post
• https://t.me/cveNotify/145893 · Telegram Post
• https://vuldb.com/?ctiid.336521 · Note
• https://vuldb.com/?id.336521 · Note