CVE-2025-14746
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A vulnerability was found in Ningyuanda TC155 version 57.0.2.0 affecting an unknown function of the RTSP Live Video Stream Endpoint component. The manipulation leads to improper authentication. The attack must be carried out from within the local network, and the exploit has been publicly disclosed.
Risk Assessment
An attacker on the same local network may gain unauthorized access to the RTSP video stream. This can lead to a breach of confidentiality of surveillance video transmissions.
Recommendation
Restrict access to the RTSP interface to trusted network segments only and consider VLAN segmentation for cameras. Contact the vendor for a fix, as they did not respond to the disclosure.
Other vulnerabilities in Ningyuanda TC155
See all- CVE-2025-14749Medium
A vulnerability was identified in Ningyuanda TC155 version 57.0.2.0 affecting an unknown function of the file /onvif/device_service of the ONVIF PTZ Control Interface component. The manipulation leads to improper access controls. The attack requires being on the local network, and the exploit is publicly available.
- CVE-2025-14748Medium
A vulnerability in Ningyuanda TC155 57.0.2.0 affects an unknown function in the file /onvif/device_service of the ONVIF Device Management Service. Manipulating the FactoryDefault argument with the value Hard leads to improper access controls. The attack requires local network access, and the exploit has been publicly disclosed.
- CVE-2025-14747Medium
A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the RTSP Service component. Manipulation results in denial of service. The attack must originate from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video Stream Endpoint. Such manipulation leads to improper authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS