Executive Summary

CVE-2025-14749 is an access control vulnerability in the Ningyuanda TC155 IP camera's ONVIF PTZ Control Interface, specifically in the /onvif/device_service endpoint. The vulnerability allows an attacker on the local network to send PTZ (pan-tilt-zoom) control commands without any authentication or access restrictions. This means an attacker can remotely control the camera's orientation and movements without needing credentials, due to improper access control in the firmware. [2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker on the same local network to take full remote control of the camera's PTZ functions without authentication. The attacker can manipulate the camera's orientation persistently, potentially redirecting or suppressing its field of view, bypassing surveillance coverage, or causing continuous disorientation of the device. This compromises the confidentiality, integrity, and availability of the device and its surveillance capabilities. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for unauthenticated SOAP requests to the /onvif/device_service endpoint of the Ningyuanda TC155 IP camera, specifically looking for PTZ control commands such as ContinuousMove. Commands like curl or SOAP client tools can be used to send test requests to the /onvif/device_service endpoint to check if PTZ commands are accepted without authentication. For example, using curl to send a SOAP request to the device's /onvif/device_service endpoint and observing if the camera responds or moves without credentials indicates the vulnerability. [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include isolating the affected Ningyuanda TC155 IP cameras on a separate VLAN or network segment to restrict local network access, disabling ONVIF PTZ control if possible, and monitoring for unauthorized PTZ commands. Since no official patch or fix is available and the vendor did not respond, replacing the affected devices with secure alternatives is recommended to fully mitigate the risk. [2]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability leads to improper access controls allowing unauthenticated local network attackers to manipulate the camera's PTZ functions, impacting confidentiality, integrity, and availability of the device. Such unauthorized access and control could result in violations of data protection and privacy regulations like GDPR and HIPAA, which require safeguarding personal data and ensuring secure access controls. The lack of vendor response and absence of mitigations further exacerbate compliance risks. [2, 3]

Useful 0 Not Useful 0